CVE-2026-52823: Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/t

Executive brief

Kimai, an open-source time-tracking application, contains a vulnerability that allows attackers to perform unauthorized actions on behalf of logged-in users. By tricking a user into visiting a malicious website, an attacker can stop active timers or restart old ones without the user's consent. This can lead to inaccurate billing, corrupted time records, and interference with workplace audits.

Technical details

Kimai is vulnerable to Cross-Site Request Forgery (CSRF) in its timesheet state-changing API endpoints. The application reuses browser sessions for API requests and incorrectly exposes state-changing operations (stop and restart) via GET and PATCH routes in `src/API/TimesheetController.php`. An attacker can exploit this by inducing an authenticated user to visit a malicious URL, triggering the `GET /api/timesheets/{id}/stop` or `GET /api/timesheets/{id}/restart` endpoints. This results in unauthorized modification of business data, such as stopping active timers or creating new records from historical data. The issue is fixed in version 2.58.0 by removing the GET routes and requiring PATCH for these operations.

Affected products

• Kimai Kimai <= 2.57.0

Timeline

• 2026-06-11: disclosed
• 2026-07-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/Mitchell45
• https://github.com/Mitchell45
• https://api.github.com/users/Mitchell45/gists%7B/gist_id%7D
• https://api.github.com/users/Mitchell45/repos
• https://avatars.githubusercontent.com/u/74776018?v=4
• https://api.github.com/users/Mitchell45/events%7B/privacy%7D