CVE-2026-52828: Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExpor

Executive brief

Kimai is an open-source time-tracking application. A security flaw was found where users with 'Teamlead' privileges can create or modify global export templates, a task normally restricted to administrators. This allows unauthorized users to change how data is formatted and presented for all users in the system, potentially affecting data integrity and reporting.

Technical details

A missing authorization check (CWE-862) exists in the Kimai ExportController. While the API and UI correctly enforce the 'create_export_template' permission (restricted to ROLE_ADMIN), the web controller routes for 'createExportTemplate' and 'editExportTemplate' only check for the broader 'create_export' permission, which is granted to ROLE_TEAMLEAD by default. Because ExportTemplate entities are global and lack per-user scoping, a TEAMLEAD can modify templates used by all users, including administrators. This vulnerability is addressed in version 2.58.0 by adding the appropriate #[IsGranted('create_export_template')] annotations.

Affected products

• Kimai Kimai <= 2.57.0

Timeline

• 2026-06-11: disclosed: Advisory published to GitHub by reporter
• 2026-07-14: advisory: Published to GitHub Advisory Database

References

• https://api.github.com/users/AzureADTrent
• https://github.com/AzureADTrent
• https://api.github.com/users/AzureADTrent/gists%7B/gist_id%7D
• https://api.github.com/users/AzureADTrent/repos
• https://avatars.githubusercontent.com/u/8278208?v=4
• https://api.github.com/users/AzureADTrent/events%7B/privacy%7D