Is CVE-2026-52826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52826 being exploited in the wild.

How severe is CVE-2026-52826?

Medium severity, with a CVSS score of 4, published 15 September 2026.

Which products and versions are affected?

Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

Is there a fix for CVE-2026-52826?

Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52826 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52826?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52826: Kimai improper authorization in rate edit endpoints

Q: Which products and versions are affected?

Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

Q: Is there a fix for CVE-2026-52826?

Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52826 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52826?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52826 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, an open-source time-tracking application, contains a security flaw that allows authorized users to modify billing rates for projects, customers, or activities they do not own. By manipulating web requests, a user could change financial configurations belonging to other teams or business domains. This could lead to incorrect invoicing, inaccurate budget reporting, and financial data integrity issues.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-52826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52826 being exploited in the wild.
How severe is CVE-2026-52826?: Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?: Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.
Is there a fix for CVE-2026-52826?: Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52826 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52826?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.57.0 or later
```
composer require kimai/kimai:^2.57.0
```

Technical details

An improper authorization vulnerability (CWE-285/CWE-639) exists in Kimai <= 2.56.0 within the Web rate editing controllers. The application independently resolves parent objects (Project, Customer, Activity) and child rate objects from URL parameters but fails to verify that the rate actually belongs to the specified parent. An authenticated attacker with permission to edit at least one parent object can provide a valid parent ID they control alongside a rate ID belonging to a different, unauthorized parent. This allows the attacker to bypass scope boundaries and modify billing-related configuration in the database. The issue is addressed in version 2.57.0 by adding parent-child consistency validation.

Affected products

Kimai Kimai <= 2.56.0

Identifiers

CVE-2026-52826
GHSA-2xgg-2x8h-8xw4

Timeline

2026-06-11: disclosed: Initial disclosure by reporter
2026-07-14: advisory: GitHub Advisory published
2026-07-14: patched: Fix released in version 2.57.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.