CVE-2026-52820: Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-contro

Executive brief

Kimai is an open-source time-tracking application. A security flaw in its API allows any registered user to assign their time entries to projects they do not belong to, including those of other customers. This can lead to unauthorized access to sensitive project metadata and the corruption of financial reports and budgets for other teams.

Technical details

An authorization bypass exists in the Kimai Timesheet API's PATCH and POST endpoints. The vulnerability stems from a Symfony EntityType query_builder in ProjectRepository.php that uses an unconditional OR branch, allowing a user-supplied project ID to satisfy the access predicate regardless of team membership. Because the TimesheetVoter only checks ownership of the timesheet and not the validity of the new project assignment, an authenticated attacker can re-assign their timesheets to any project ID. This allows the attacker to leak serialized project and customer metadata (via the ?full=true parameter) and pollute the reporting data of other teams. The issue is addressed in version 2.57.0 by adding a TimesheetTeamAccessValidator.

Affected products

• Kimai Kimai <= 2.56.0

Timeline

• 2026-06-11: disclosed
• 2026-07-13: advisory
• 2026-07-13: patched

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D