Is CVE-2026-52820 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52820 being exploited in the wild.

How severe is CVE-2026-52820?

Medium severity, with a CVSS score of 4, published 15 September 2026.

Which products and versions are affected?

Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

Is there a fix for CVE-2026-52820?

Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52820 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52820?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52820: Kimai Timesheet authorization bypass in project assignment

Q: Which products and versions are affected?

Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

Q: Is there a fix for CVE-2026-52820?

Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52820 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52820?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52820 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai is an open-source time-tracking application. A security flaw in its API allows any registered user to assign their time entries to projects they do not belong to, including those of other customers. This can lead to unauthorized access to sensitive project metadata and the corruption of financial reports and budgets for other teams.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-52820 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52820 being exploited in the wild.
How severe is CVE-2026-52820?: Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?: Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.
Is there a fix for CVE-2026-52820?: Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52820 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52820?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.57.0 or later
```
composer require kimai/kimai:^2.57.0
```

Technical details

An authorization bypass exists in the Kimai Timesheet API's PATCH and POST endpoints. The vulnerability stems from a Symfony EntityType query_builder in ProjectRepository.php that uses an unconditional OR branch, allowing a user-supplied project ID to satisfy the access predicate regardless of team membership. Because the TimesheetVoter only checks ownership of the timesheet and not the validity of the new project assignment, an authenticated attacker can re-assign their timesheets to any project ID. This allows the attacker to leak serialized project and customer metadata (via the ?full=true parameter) and pollute the reporting data of other teams. The issue is addressed in version 2.57.0 by adding a TimesheetTeamAccessValidator.

Affected products

Kimai Kimai <= 2.56.0

Identifiers

CVE-2026-52820
GHSA-vrr2-g9gh-c3jc

Timeline

2026-06-11: disclosed
2026-07-13: advisory
2026-07-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.