CVE-2026-52820
Received Received - Intake

Unauthorized Project Assignment in Kimai Time Tracking

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52820
EUVD
EUVD-2026-78399

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kimai kimai to 2.57.0 (inc)
kimai kimai to 2.57.0 (exc)
kimai kimai 2.57.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52820 is a medium-severity vulnerability in Kimai versions 2.56.0 and earlier. It allows authenticated users to assign their timesheets to projects they do not have access to via the API endpoints PATCH /api/timesheets/{id} and POST /api/timesheets. The flaw bypasses team or customer restrictions due to insufficient validation of project access permissions.

Detection Guidance

Check Kimai API logs for unusual PATCH or POST requests to /api/timesheets/{id} with project ID changes. Monitor for timesheets assigned to projects outside user teams. Use network traffic analysis to detect unauthorized API calls.

Impact Analysis

This vulnerability allows users to modify their own timesheet entries to link to unauthorized projects. This can corrupt billing data by falsely attributing time to projects outside their access. It also leaks sensitive project and customer metadata through the API's full serialization response.

Mitigation Strategies

Upgrade Kimai to version 2.57.0 or later immediately. Review timesheet assignments for unauthorized project changes. Restrict edit_own_timesheet permissions if not required. Monitor API access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart