# CVE-2026-52820: Kimai Timesheet authorization bypass in project assignment

Source: https://junglewise.ai/threats/cve-2026-52820-kimai-timesheet-authorization-bypass-in-project-assignment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-52820 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai is an open-source time-tracking application. A security flaw in its API allows any registered user to assign their time entries to projects they do not belong to, including those of other customers. This can lead to unauthorized access to sensitive project metadata and the corruption of financial reports and budgets for other teams.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52820 being exploited in the wild.

**How severe is CVE-2026-52820?** Medium severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

**Is there a fix for CVE-2026-52820?** Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52820 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52820?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.57.0 or later

  ```sh
  composer require kimai/kimai:^2.57.0
  ```


## Technical details

An authorization bypass exists in the Kimai Timesheet API's PATCH and POST endpoints. The vulnerability stems from a Symfony EntityType query_builder in ProjectRepository.php that uses an unconditional OR branch, allowing a user-supplied project ID to satisfy the access predicate regardless of team membership. Because the TimesheetVoter only checks ownership of the timesheet and not the validity of the new project assignment, an authenticated attacker can re-assign their timesheets to any project ID. This allows the attacker to leak serialized project and customer metadata (via the ?full=true parameter) and pollute the reporting data of other teams. The issue is addressed in version 2.57.0 by adding a TimesheetTeamAccessValidator.

## Affected products

- Kimai Kimai <= 2.56.0

## Identifiers

- CVE-2026-52820
- GHSA-vrr2-g9gh-c3jc

## Timeline

- 2026-06-11: disclosed
- 2026-07-13: advisory
- 2026-07-13: patched

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)