CVE-2026-52823
Received Received - Intake

CSRF in Kimai Time Tracking Application

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52823
EUVD
EUVD-2026-78404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.58.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52823 is a Cross-Site Request Forgery (CSRF) vulnerability in Kimai time tracking software versions before 2.58.0. It involves GET endpoints that allow stopping or restarting timesheets without proper request-forgery protection. Attackers can trick authenticated users into visiting malicious links to trigger these state-changing operations.

Detection Guidance

Detect this vulnerability by checking Kimai versions before 2.58.0. Inspect server logs for unusual GET requests to /api/timesheets/{id}/stop or /api/timesheets/{id}/restart endpoints. Verify if these endpoints are accessible via GET methods.

Impact Analysis

An attacker could stop your active timesheet or restart an old one, creating unauthorized new time entries. This corrupts your time records, billing data, reports, approvals, and audit trails without your consent. The attack requires you to be logged in and visit a malicious page.

Compliance Impact

This vulnerability could lead to inaccurate time tracking records, which may violate compliance requirements for data integrity in GDPR and HIPAA. Unauthorized modifications to billing or audit data could result in non-compliance with record-keeping regulations.

Mitigation Strategies

Immediately update Kimai to version 2.58.0 or later. Remove or disable GET requests for /api/timesheets/{id}/stop and /api/timesheets/{id}/restart endpoints. Ensure all state-changing operations use PATCH requests only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart