Is CVE-2026-52823 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52823 being exploited in the wild.

How severe is CVE-2026-52823?

Medium severity, with a CVSS score of 4, published 15 September 2026.

Which products and versions are affected?

Kimai <= 2.57.0; kimai/kimai (Packagist) <= 2.57.0, ECOSYSTEM:introduced=0,fixed=2.58.0.

Is there a fix for CVE-2026-52823?

Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52823 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52823?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52823: Kimai CSRF in Timesheet Stop and Restart API endpoints

Q: Which products and versions are affected?

Kimai <= 2.57.0; kimai/kimai (Packagist) <= 2.57.0, ECOSYSTEM:introduced=0,fixed=2.58.0.

Q: Is there a fix for CVE-2026-52823?

Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52823 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52823?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52823 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, an open-source time-tracking application, contains a vulnerability that allows attackers to perform unauthorized actions on behalf of logged-in users. By tricking a user into visiting a malicious website, an attacker can stop active timers or restart old ones without the user's consent. This can lead to inaccurate billing, corrupted time records, and interference with workplace audits.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-52823 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52823 being exploited in the wild.
How severe is CVE-2026-52823?: Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?: Kimai <= 2.57.0; kimai/kimai (Packagist) <= 2.57.0, ECOSYSTEM:introduced=0,fixed=2.58.0.
Is there a fix for CVE-2026-52823?: Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52823 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52823?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.58.0 or later
```
composer require kimai/kimai:^2.58.0
```

Technical details

Kimai is vulnerable to Cross-Site Request Forgery (CSRF) in its timesheet state-changing API endpoints. The application reuses browser sessions for API requests and incorrectly exposes state-changing operations (stop and restart) via GET and PATCH routes in `src/API/TimesheetController.php`. An attacker can exploit this by inducing an authenticated user to visit a malicious URL, triggering the `GET /api/timesheets/{id}/stop` or `GET /api/timesheets/{id}/restart` endpoints. This results in unauthorized modification of business data, such as stopping active timers or creating new records from historical data. The issue is fixed in version 2.58.0 by removing the GET routes and requiring PATCH for these operations.

Affected products

Kimai Kimai <= 2.57.0

Identifiers

CVE-2026-52823
GHSA-r8vr-m544-qh4h

Timeline

2026-06-11: disclosed
2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.