# CVE-2026-28685: Kimai missing authorization in API invoice endpoint

Source: https://junglewise.ai/threats/cve-2026-28685-kimai-missing-authorization-in-api-invoice-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-04. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-28685 · Severity: medium · CVSS 6.5 · Published 2026-03-04

Kimai is an open-source time-tracking application used by businesses to manage projects and billing. A security flaw in the application's programming interface (API) allows users with 'Teamlead' privileges to view financial invoices belonging to any customer in the system, even those outside their assigned team. This could lead to the unauthorized exposure of sensitive financial data, including billing amounts and customer details, potentially damaging business confidentiality in multi-tenant environments.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-28685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28685 being exploited in the wild.

**How severe is CVE-2026-28685?** Medium severity, with a CVSS score of 6.5, published 4 March 2026.

**Which products and versions are affected?** Kimai <= 2.50.0; kimai/kimai (Packagist) <= 2.50.0, ECOSYSTEM:introduced=0,fixed=2.51.0.

**Is there a fix for CVE-2026-28685?** Yes. kimai/kimai (Packagist): upgrade to 2.51.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28685 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-28685?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.51.0 or later

  ```sh
  composer require kimai/kimai:^2.51.0
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `GET /api/invoices/{id}` endpoint of Kimai. While the endpoint correctly verifies that a user has the `view_invoice` role, it fails to validate if the user has specific 'access' permissions for the customer associated with the requested invoice. This check is present in the web-based controller but missing in the API controller (`src/API/InvoiceController.php`). An attacker with `ROLE_TEAMLEAD` credentials can exploit this by providing an invoice ID in the API request to bypass team-based data isolation and retrieve sensitive financial records. The vulnerability is addressed in version 2.51.0.

## Affected products

- Kimai Kimai <= 2.50.0

## Identifiers

- CVE-2026-28685
- GHSA-v33r-r6h2-8wr7

## Timeline

- 2026-03-04: disclosed
- 2026-03-04: advisory
- 2026-03-04: patched: Fixed in version 2.51.0

## References

- [https://api.github.com/users/CE2Sec](https://api.github.com/users/CE2Sec)
- [https://github.com/CE2Sec](https://github.com/CE2Sec)
- [https://api.github.com/users/CE2Sec/gists%7B/gist_id%7D](https://api.github.com/users/CE2Sec/gists%7B/gist_id%7D)
- [https://api.github.com/users/CE2Sec/repos](https://api.github.com/users/CE2Sec/repos)
- [https://avatars.githubusercontent.com/u/135195424?v=4](https://avatars.githubusercontent.com/u/135195424?v=4)
- [https://api.github.com/users/CE2Sec/events%7B/privacy%7D](https://api.github.com/users/CE2Sec/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)