CVE-2026-52819
Received Received - Intake

Kimai Time Tracking App Unauthorized Timesheet Data Exposure

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target identifiers from a caller with view_other_timesheet but does not apply access_user or verify that a ROLE_TEAMLEAD requester leads a team containing each target user. TimesheetController::cgetAction() adds the resolved users directly to the query while project and customer filtering still permits records on unscoped projects or projects sharing ordinary team membership, allowing a teamlead to retrieve another user's descriptions, timing data, tags, rate, and internalRate even though GET /api/timesheets/{id} would deny access through TimesheetVoter. This issue is fixed in version 2.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52819
EUVD
EUVD-2026-78398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai 2.57.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kimai allows a teamlead with view_other_timesheet permission to access timesheet records of other users without proper authorization. The GET /api/timesheets endpoint fails to verify if the requester is the teamlead of the target user, only filtering by project or team membership. This exposes sensitive data like financial fields, activity descriptions, timestamps, and project details.

Detection Guidance

To detect this vulnerability, check if your Kimai instance is running a version prior to 2.57.0. Use commands like 'composer show kimai/kimai' or check the version in the admin panel. Verify if team leads can access timesheet data of users they do not supervise via the GET /api/timesheets endpoint with user or users[] parameters.

Impact Analysis

If you are a teamlead in Kimai versions 2.56.0 or earlier, you could access timesheet data of users you do not supervise. If you are a regular user, your timesheet data could be exposed to unauthorized teamleads. Sensitive information like rates, internal rates, and activity descriptions may be leaked.

Compliance Impact

This vulnerability could lead to unauthorized access to personal and financial data, violating GDPR principles of data minimization and integrity. For HIPAA, exposure of sensitive time-tracking data may breach confidentiality requirements. Organizations must ensure proper access controls to maintain compliance.

Mitigation Strategies

Immediately upgrade Kimai to version 2.57.0 or later. This version includes the fix for unauthorized timesheet access. Ensure no team leads have unnecessary view_other_timesheet permissions and review API access logs for suspicious activity targeting the /api/timesheets endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart