CVE-2026-52820

Kimai , an open-source PHP/Symfony time-tracking application, is affected by an authorization bypass in the PATCH /api/timesheets/{id} and POST /api/timesheets endpoints (prior to 2.57.0 ). A user-supplied project ID is injected into ProjectRepository::getQueryBuilderForFormType(), where it appea...

Authorization Bypass

Kimai is vulnerable to Authorization Bypass. The vulnerability is due to insufficient team-lead authorization checks in the timesheet list API when filtering by user ID, which allows an attacker with viewothertimesheet permission to enumerate other users' timesheet records and disclose sensitive...