CVE-2026-52821
Received Received - Intake

Privilege Escalation in Kimai Time Tracking App

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{customer} require only the generic create_activity or create_project capability and do not verify edit access to the supplied Project or Customer object. A user who knows a valid project.id or customer identifier can use the preset-parent creation logic in src/Controller/ActivityController.php or src/Controller/ProjectController.php to persist a new child business object under an unauthorized parent, polluting project or customer configuration and influencing later time-entry, rate, reporting, and billing behavior. This issue is fixed in version 2.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52821
EUVD
EUVD-2026-78400

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kimai kimai to 2.57.0 (exc)
kimai kimai 2.57.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kimai versions 2.56.0 and earlier is an authorization bypass issue. It allows authenticated users with generic create permissions but without specific project access to create activities or projects under unauthorized parent objects by manipulating URLs. The flaw exists because the system fails to verify edit access to referenced projects or customers during creation via preset routes like /en/admin/activity/create/{project} or /en/admin/project/create/{customer}. A valid project or customer ID is required to exploit this.

Detection Guidance

Check Kimai version with: grep -r "version" /path/to/kimai/vendor/kimai/kimai/composer.json. If version is 2.56.0 or earlier, the system is vulnerable. Inspect web server logs for unusual POST requests to /en/admin/activity/create/{project} or /en/admin/project/create/{customer} with valid project or customer IDs.

Impact Analysis

An attacker could create unauthorized activities or projects under another team's configuration, polluting their setup. This could influence timesheet selection, rate inheritance, and billing behavior. For example, an employee could manipulate records to charge time to incorrect projects or customers, leading to financial discrepancies or compliance violations.

Compliance Impact

This vulnerability could lead to inaccurate time tracking and billing, potentially violating record-keeping requirements under GDPR or HIPAA. Incorrect project associations might result in unauthorized access to sensitive data or improper handling of personal information, creating compliance risks for organizations subject to these regulations.

Mitigation Strategies

Upgrade Kimai to version 2.57.0 or later immediately. Review user permissions to ensure only authorized users have create_activity or create_project capabilities. Monitor for unauthorized activity or project creation attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart