Is CVE-2026-80197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80197 being exploited in the wild.

How severe is CVE-2026-80197?

Medium severity, with a CVSS score of 4.3, published 26 August 2026.

Which products and versions are affected?

Kimai before 2.57.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.57.0.

Is there a fix for CVE-2026-80197?

Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80197 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80197?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80197: Kimai improper authorization in favorite timesheet endpoints

CVE-2026-80197 · Severity: medium · CVSS 4.3 · Published 2026-08-26

Kimai is a time-tracking and project management application used by teams to log and manage work hours. A vulnerability in the favorite timesheet feature allows any authenticated user to manipulate another user's bookmarked timesheets—adding or removing entries from their favorites list—without permission, disrupting their workflow and normal operations without requiring administrative access.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-80197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80197 being exploited in the wild.
How severe is CVE-2026-80197?: Medium severity, with a CVSS score of 4.3, published 26 August 2026.
Which products and versions are affected?: Kimai before 2.57.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.57.0.
Is there a fix for CVE-2026-80197?: Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80197 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80197?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.57.0 or later
```
composer require kimai/kimai:^2.57.0
```

Technical details

The vulnerability is an improper authorization (IDOR) flaw in the GET /en/favorite/timesheet/add/{id} and GET /en/favorite/timesheet/remove/{id} endpoints. The affected controller (FavoriteController.php) accepts a user-controlled timesheet identifier but fails to verify that the timesheet belongs to the authenticated user; instead, it derives the bookmark owner from the timesheet object itself rather than the current session user. An attacker with the generic start_own_timesheet permission can reference another user's timesheet ID to add or remove it from that user's favorites. The vulnerability has been patched in Kimai 2.57.0 and affects all versions up to and including 2.56.0.

Affected products

Kimai Kimai before 2.57.0

Identifiers

CVE-2026-80197
GHSA-j5mc-p8qg-39j7

Timeline

2026-05-29: disclosed: GitHub Security Advisory GHSA-j5mc-p8qg-39j7 published
2026-08-26: advisory: CVE-2026-80197 published
2026-05-29: patched: Fixed in Kimai 2.57.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.