Is CVE-2026-80193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80193 being exploited in the wild.

How severe is CVE-2026-80193?

High severity, with a CVSS score of 8.8, published 26 August 2026.

Is there a fix for CVE-2026-80193?

A patch was published on 2026-07-09: Fix released in version 2.62.0 (three weeks before advisory submission) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80193 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80193?

Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80193: Kimai QuickEntry authorization bypass in timesheet creation

CVE-2026-80193 · Severity: high · CVSS 8.8 · Published 2026-08-26

Kimai is a time-tracking application used to record and manage employee work hours for billing and payroll purposes. A flaw in the QuickEntry timesheet form allows authenticated users to create new timesheet records for team members even when they lack the explicit permission to do so. Attackers could fabricate billable hours, inflate project budgets, or falsely attribute work to other employees, directly impacting billing accuracy and payroll integrity.

Technologies: Kimai. Vendors: Kimai.

Quick answers

Is CVE-2026-80193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80193 being exploited in the wild.
How severe is CVE-2026-80193?: High severity, with a CVSS score of 8.8, published 26 August 2026.
Which products and versions are affected?: Kimai before 2.62.0.
Is there a fix for CVE-2026-80193?: A patch was published on 2026-07-09: Fix released in version 2.62.0 (three weeks before advisory submission) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80193 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80193?: Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The QuickEntry controller in Kimai before version 2.62.0 fails to validate the create_other_timesheet permission when processing new timesheet submissions. The vulnerability exists in src/Controller/QuickEntryController.php where the user-switcher is gated by view_other_timesheet instead of create_other_timesheet (line 59), and new timesheet records (id === null) are unconditionally forwarded to updateMultipleTimesheets() without authorization checks (lines 274-285). An authenticated attacker with view_other_timesheet and edit_other_timesheet permissions but explicitly denied create_other_timesheet can exploit this by submitting the QuickEntry form with a duration for a new timesheet row, creating fraudulent time records for team members they oversee. The fix, already released in version 2.62.0, adds proper authorization validation to gate the user-switcher by the correct permission and validates creation rights before processing new records.

Affected products

Kimai Kimai before 2.62.0

Timeline

2026-08-09: disclosed: GHSA-2w7f-x78f-89q2 published by GitHub
2026-07-09: patched: Fix released in version 2.62.0 (three weeks before advisory submission)
2026-08-26: other: CVE-2026-80193 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.