# CVE-2026-52826: Kimai improper authorization in rate edit endpoints

Source: https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-52826 · Severity: medium · CVSS 4 · Published 2026-09-15

Kimai, an open-source time-tracking application, contains a security flaw that allows authorized users to modify billing rates for projects, customers, or activities they do not own. By manipulating web requests, a user could change financial configurations belonging to other teams or business domains. This could lead to incorrect invoicing, inaccurate budget reporting, and financial data integrity issues.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52826 being exploited in the wild.

**How severe is CVE-2026-52826?** Medium severity, with a CVSS score of 4, published 15 September 2026.

**Which products and versions are affected?** Kimai <= 2.56.0; kimai/kimai (Packagist) <= 2.56.0, ECOSYSTEM:introduced=0,fixed=2.57.0.

**Is there a fix for CVE-2026-52826?** Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52826 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52826?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.57.0 or later

  ```sh
  composer require kimai/kimai:^2.57.0
  ```


## Technical details

An improper authorization vulnerability (CWE-285/CWE-639) exists in Kimai <= 2.56.0 within the Web rate editing controllers. The application independently resolves parent objects (Project, Customer, Activity) and child rate objects from URL parameters but fails to verify that the rate actually belongs to the specified parent. An authenticated attacker with permission to edit at least one parent object can provide a valid parent ID they control alongside a rate ID belonging to a different, unauthorized parent. This allows the attacker to bypass scope boundaries and modify billing-related configuration in the database. The issue is addressed in version 2.57.0 by adding parent-child consistency validation.

## Affected products

- Kimai Kimai <= 2.56.0

## Identifiers

- CVE-2026-52826
- GHSA-2xgg-2x8h-8xw4

## Timeline

- 2026-06-11: disclosed: Initial disclosure by reporter
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Fix released in version 2.57.0

## References

- [https://api.github.com/users/Mitchell45](https://api.github.com/users/Mitchell45)
- [https://github.com/Mitchell45](https://github.com/Mitchell45)
- [https://api.github.com/users/Mitchell45/gists%7B/gist_id%7D](https://api.github.com/users/Mitchell45/gists%7B/gist_id%7D)
- [https://api.github.com/users/Mitchell45/repos](https://api.github.com/users/Mitchell45/repos)
- [https://avatars.githubusercontent.com/u/74776018?v=4](https://avatars.githubusercontent.com/u/74776018?v=4)
- [https://api.github.com/users/Mitchell45/events%7B/privacy%7D](https://api.github.com/users/Mitchell45/events%7B/privacy%7D)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)
- [Kimai CSRF in Timesheet Stop and Restart API endpoints](https://junglewise.ai/threats/cve-2026-52823-kimai-csrf-in-timesheet-stop-and-restart-api-endpoints)