Quick answers
- Is CVE-2026-28685 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28685 being exploited in the wild.
- How severe is CVE-2026-28685?
- Medium severity, with a CVSS score of 6.5, published 4 March 2026.
- Which products and versions are affected?
- Kimai <= 2.50.0; kimai/kimai (Packagist) <= 2.50.0, ECOSYSTEM:introduced=0,fixed=2.51.0.
- Is there a fix for CVE-2026-28685?
- Yes. kimai/kimai (Packagist): upgrade to 2.51.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28685 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-28685?
- Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- kimai/kimai (Packagist): upgrade to 2.51.0 or later
composer require kimai/kimai:^2.51.0
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `GET /api/invoices/{id}` endpoint of Kimai. While the endpoint correctly verifies that a user has the `view_invoice` role, it fails to validate if the user has specific 'access' permissions for the customer associated with the requested invoice. This check is present in the web-based controller but missing in the API controller (`src/API/InvoiceController.php`). An attacker with `ROLE_TEAMLEAD` credentials can exploit this by providing an invoice ID in the API request to bypass team-based data isolation and retrieve sensitive financial records. The vulnerability is addressed in version 2.51.0.
Affected products
- Kimai Kimai <= 2.50.0
Identifiers
- CVE-2026-28685
- GHSA-v33r-r6h2-8wr7
Timeline
- 2026-03-04: disclosed
- 2026-03-04: advisory
- 2026-03-04: patched: Fixed in version 2.51.0