# CVE-2026-80197: Kimai improper authorization in favorite timesheet endpoints

Source: https://junglewise.ai/threats/cve-2026-80197-kimai-improper-authorization-in-favorite-timesheet-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80197 · Severity: medium · CVSS 4.3 · Published 2026-08-26

Kimai is a time-tracking and project management application used by teams to log and manage work hours. A vulnerability in the favorite timesheet feature allows any authenticated user to manipulate another user's bookmarked timesheets—adding or removing entries from their favorites list—without permission, disrupting their workflow and normal operations without requiring administrative access.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-80197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80197 being exploited in the wild.

**How severe is CVE-2026-80197?** Medium severity, with a CVSS score of 4.3, published 26 August 2026.

**Which products and versions are affected?** Kimai before 2.57.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.57.0.

**Is there a fix for CVE-2026-80197?** Yes. kimai/kimai (Packagist): upgrade to 2.57.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80197 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-80197?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.57.0 or later

  ```sh
  composer require kimai/kimai:^2.57.0
  ```


## Technical details

The vulnerability is an improper authorization (IDOR) flaw in the GET /en/favorite/timesheet/add/{id} and GET /en/favorite/timesheet/remove/{id} endpoints. The affected controller (FavoriteController.php) accepts a user-controlled timesheet identifier but fails to verify that the timesheet belongs to the authenticated user; instead, it derives the bookmark owner from the timesheet object itself rather than the current session user. An attacker with the generic start_own_timesheet permission can reference another user's timesheet ID to add or remove it from that user's favorites. The vulnerability has been patched in Kimai 2.57.0 and affects all versions up to and including 2.56.0.

## Affected products

- Kimai Kimai before 2.57.0

## Identifiers

- CVE-2026-80197
- GHSA-j5mc-p8qg-39j7

## Timeline

- 2026-05-29: disclosed: GitHub Security Advisory GHSA-j5mc-p8qg-39j7 published
- 2026-08-26: advisory: CVE-2026-80197 published
- 2026-05-29: patched: Fixed in Kimai 2.57.0

## References

- [https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7](https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7)
- [https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints](https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)