CVE-2026-52822: Kimai improper authorization in timesheet restart and duplicate workflows

CVE-2026-52822 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, an open-source time-tracking application, contains a flaw that allows users to continue logging time against projects even after their access has been revoked. By using the 'restart' or 'duplicate' features on their historical entries, users can bypass administrative restrictions. This can lead to inaccurate project billing, budget pollution, and unauthorized data entry in corporate invoicing workflows.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-52822 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52822 being exploited in the wild.
How severe is CVE-2026-52822?
Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
Kimai <= 2.57.0; kimai/kimai (Packagist) <= 2.57.0, ECOSYSTEM:introduced=0,fixed=2.58.0.
Is there a fix for CVE-2026-52822?
Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52822 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-52822?
Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • kimai/kimai (Packagist): upgrade to 2.58.0 or later
    composer require kimai/kimai:^2.58.0

Technical details

An improper authorization vulnerability exists in Kimai's `restart` and `duplicate` workflows (specifically `PATCH /api/timesheets/{id}/restart` and `PATCH /api/timesheets/{id}/duplicate`). The root cause is located in `src/Voter/TimesheetVoter.php`, where the logic grants access based on the user's ownership of a historical record before verifying current team-based project permissions. An authenticated attacker can use an old timesheet entry as a 'capability token' to persist new records to the database for a revoked project. The fix, introduced in version 2.58.0, updates `TimesheetVoter::canStart()` to enforce team-access checks for both projects and activities during duplication and restart flows.

Affected products

  • Kimai Kimai <= 2.57.0

Identifiers

  • CVE-2026-52822
  • GHSA-c6w6-57jj-62vh

Timeline

  • 2026-06-11: disclosed
  • 2026-07-14: advisory: GitHub Advisory published
  • 2026-07-14: patched: Version 2.58.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.