CVE-2026-49992

Received Received - Intake

Authenticated CSRF in Kimai Time Tracking App

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-49992

Affected Vendors & Products

Vendor	Product	Version / Range
kimai	kimai	to 2.58.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an authenticated cross-site request forgery (CSRF) issue in Kimai versions before 2.58.0. It affects default team creation shortcuts for projects, customers, and activities via GET routes. An attacker can trick a logged-in user with permissions into visiting a malicious page, causing unauthorized changes to team structures, teamlead assignments, and object bindings.

Detection Guidance

To detect this vulnerability, check if your Kimai instance is running a version prior to 2.58.0. Use commands like 'composer show kimai/kimai' or check the version in the web interface. Verify if GET routes for team creation shortcuts exist and if unauthorized team or binding changes are logged.

Impact Analysis

If exploited, this vulnerability allows attackers to modify team, teamlead, and object-binding relationships without proper authorization. This could lead to unauthorized access, data manipulation, or disruption of time tracking functionality for users with sufficient permissions.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modifications to team structures and object bindings through CSRF attacks. Unauthorized changes may lead to improper access controls or data exposure, violating regulatory requirements for data protection and integrity.

Mitigation Strategies

Immediately upgrade Kimai to version 2.58.0 or later to patch the vulnerability. Ensure no unauthorized changes have occurred by reviewing team, teamlead, and object-binding relationships. Monitor logs for suspicious activity related to these endpoints.

Hi! I’m here to help you understand CVE-2026-49992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70