# CVE-2026-52822: Kimai improper authorization in timesheet restart and duplicate workflows

Source: https://junglewise.ai/threats/cve-2026-52822-kimai-improper-authorization-in-timesheet-restart-and-duplicate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-52822 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, an open-source time-tracking application, contains a flaw that allows users to continue logging time against projects even after their access has been revoked. By using the 'restart' or 'duplicate' features on their historical entries, users can bypass administrative restrictions. This can lead to inaccurate project billing, budget pollution, and unauthorized data entry in corporate invoicing workflows.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52822 being exploited in the wild.

**How severe is CVE-2026-52822?** Medium severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** Kimai <= 2.57.0; kimai/kimai (Packagist) <= 2.57.0, ECOSYSTEM:introduced=0,fixed=2.58.0.

**Is there a fix for CVE-2026-52822?** Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52822 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-52822?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.58.0 or later

  ```sh
  composer require kimai/kimai:^2.58.0
  ```


## Technical details

An improper authorization vulnerability exists in Kimai's `restart` and `duplicate` workflows (specifically `PATCH /api/timesheets/{id}/restart` and `PATCH /api/timesheets/{id}/duplicate`). The root cause is located in `src/Voter/TimesheetVoter.php`, where the logic grants access based on the user's ownership of a historical record before verifying current team-based project permissions. An authenticated attacker can use an old timesheet entry as a 'capability token' to persist new records to the database for a revoked project. The fix, introduced in version 2.58.0, updates `TimesheetVoter::canStart()` to enforce team-access checks for both projects and activities during duplication and restart flows.

## Affected products

- Kimai Kimai <= 2.57.0

## Identifiers

- CVE-2026-52822
- GHSA-c6w6-57jj-62vh

## Timeline

- 2026-06-11: disclosed
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 2.58.0 released

## References

- [https://api.github.com/users/Mitchell45](https://api.github.com/users/Mitchell45)
- [https://github.com/Mitchell45](https://github.com/Mitchell45)
- [https://api.github.com/users/Mitchell45/gists%7B/gist_id%7D](https://api.github.com/users/Mitchell45/gists%7B/gist_id%7D)
- [https://api.github.com/users/Mitchell45/repos](https://api.github.com/users/Mitchell45/repos)
- [https://avatars.githubusercontent.com/u/74776018?v=4](https://avatars.githubusercontent.com/u/74776018?v=4)
- [https://api.github.com/users/Mitchell45/events%7B/privacy%7D](https://api.github.com/users/Mitchell45/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)