CVE-2026-52825
Received Received - Intake

Privilege Escalation in Kimai Time Tracking App

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the referenced User or view access for the referenced Activity. A teamlead can add users or activities outside the teamlead's manageable scope to an editable team, bypassing the narrower choices enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType(). The resulting relationships can be trusted by RolePermissionManager::checkTeamAccessActivity() and other team-based authorization, visibility, reporting, and workflow logic. This issue is fixed in version 2.58.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52825
EUVD
EUVD-2026-78401

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kimai kimai 2.58.0
kimai kimai to 2.58.0 (exc)
kimai kimai From 2.58.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52825 is an improper authorization flaw in Kimai, an open-source time tracking app. It affects versions 2.57.0 and earlier. Team leads with edit permissions could exploit API endpoints to add users or activities outside their authorized scope. The backend did not verify access permissions for referenced objects, only team edit rights. This allowed unauthorized expansion of team scope through direct API calls, bypassing frontend restrictions.

Detection Guidance

To detect this vulnerability, check if your Kimai instance is running a version prior to 2.58.0. Use commands like 'curl -s https://your-kimai-instance.com/api/version' or check the version in the admin panel. If the version is below 2.58.0, the system may be vulnerable.

Impact Analysis

This vulnerability could lead to unauthorized data exposure. Team leads might add users, customers, projects, or activities to their teams that they shouldn't have access to. This could affect time entries, statistics, reporting, and team-based access control. The impact occurs only through API exploitation, not the web interface.

Compliance Impact

This vulnerability could compromise compliance by allowing unauthorized access to sensitive data. For GDPR, it may violate data minimization and access control principles. For HIPAA, it could lead to unauthorized exposure of protected health information. The unauthorized team expansions might grant access to data beyond intended scopes, creating potential compliance violations.

Mitigation Strategies

Immediately update Kimai to version 2.58.0 or later. This can be done by following the official Kimai update instructions. Ensure that all team leads and users with elevated permissions are aware of the update and verify that the new version includes the additional permission checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart