CVE-2026-80202
Received Received - Intake

Authentication Bypass in Kimai Timesheet via Permission Mapping

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80202

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.56.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kimai before version 2.56.0 has a vulnerability where team-membership checks are not enforced in TimesheetVoter::voteOnAttribute(). This allows users with ROLE_TEAMLEAD or roles holding edit_other_timesheet/delete_other_timesheet permissions to read, modify, or delete timesheets belonging to any user across the system via the API, regardless of team membership. Timesheet IDs are sequential and easily guessable.

Detection Guidance

Check Kimai version with 'composer show kimai/kimai' or 'php bin/console about'. If version is below 2.56.0, the system is vulnerable. Review API logs for unauthorized timesheet access attempts or modifications by non-team members.

Impact Analysis

If you are a user with ROLE_TEAMLEAD or similar elevated permissions in Kimai before 2.56.0, an attacker could exploit this to access, alter, or delete timesheets of other users without authorization. Even users without direct access could have their timesheets exposed or manipulated if they share a system with vulnerable roles.

Compliance Impact

This vulnerability could lead to unauthorized access, modification, or deletion of sensitive time-tracking data, violating GDPR principles of data integrity and confidentiality. For HIPAA, it risks exposing protected health information if timesheets contain related data, leading to compliance failures and potential legal consequences.

Mitigation Strategies

Upgrade Kimai to version 2.56.0 or later immediately. Review and revoke unnecessary ROLE_TEAMLEAD or elevated permissions. Audit timesheet access logs for signs of exploitation. Implement network segmentation to limit API exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart