# CVE-2026-52819: Kimai authorization bypass in GET /api/timesheets API

Source: https://junglewise.ai/threats/cve-2026-52819-kimai-authorization-bypass-in-get-api-timesheets-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-52819 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, a popular open-source time-tracking application, contains a security flaw that allows users with 'Teamlead' roles to view the timesheets of any other user in the system. This bypasses intended privacy controls, potentially exposing sensitive activity logs and financial billing rates for employees outside of the teamlead's authorized scope. An exploit could lead to the unauthorized disclosure of personal activity data and corporate financial information.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52819 being exploited in the wild.

**How severe is CVE-2026-52819?** Medium severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

**Is there a fix for CVE-2026-52819?** Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52819 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52819?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.57.0 or later

  ```sh
  composer require kimai/kimai:^2.57.0
  ```


## Technical details

An authorization mismatch exists between the per-record voter and the collection endpoint in Kimai's API. While the `GET /api/timesheets/{id}` endpoint correctly enforces teamlead-of-target checks via `TimesheetVoter`, the list endpoint `GET /api/timesheets` only checks for the global `view_other_timesheet` permission, which is granted to all teamleads. An attacker with `ROLE_TEAMLEAD` can use the `user` or `users[]` query parameters to retrieve records for any user, provided the records are on projects without team scoping or projects where the attacker is a member. This leaks sensitive fields including `rate`, `internalRate`, and activity descriptions. The issue is fixed in version 2.57.0 by introducing the `access_user` permission check in `TimesheetController::cgetAction()`.

## Affected products

- Kimai Kimai <= 2.56.0

## Identifiers

- CVE-2026-52819
- GHSA-4m8q-55qv-9pwp

## Timeline

- 2026-06-11: disclosed: Initial disclosure to vendor
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-13: patched: Fix released in version 2.57.0

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)