Is CVE-2026-80202 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80202 being exploited in the wild.

How severe is CVE-2026-80202?

High severity, with a CVSS score of 8.8, published 26 August 2026.

Which products and versions are affected?

Kimai before 2.56.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.56.0.

Is there a fix for CVE-2026-80202?

Yes. kimai/kimai (Packagist): upgrade to 2.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80202 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80202?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80202: Kimai authorization bypass in timesheet voter

CVE-2026-80202 · Severity: high · CVSS 8.8 · Published 2026-08-26

Kimai is a time-tracking application used to record and manage employee work hours. A flaw in its permission system allows any team lead user to view, modify, and permanently delete timesheets belonging to any employee across the entire system—including those on different teams or with no team affiliation. An attacker with team lead privileges can tamper with billable hours, delete payroll records, and forge timesheet data affecting invoicing and compensation.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-80202 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80202 being exploited in the wild.
How severe is CVE-2026-80202?: High severity, with a CVSS score of 8.8, published 26 August 2026.
Which products and versions are affected?: Kimai before 2.56.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.56.0.
Is there a fix for CVE-2026-80202?: Yes. kimai/kimai (Packagist): upgrade to 2.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80202 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80202?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.56.0 or later
```
composer require kimai/kimai:^2.56.0
```

Technical details

The vulnerability is a missing authorization check in TimesheetVoter::voteOnAttribute() (CWE-863: Incorrect Authorization). The voter maps permissions only to `own_timesheet` or `other_timesheet` without validating team membership, allowing ROLE_TEAMLEAD users to access any timesheet via the API regardless of team affiliation. Attack surface is network-accessible (API endpoints), no special privileges or interaction required beyond authentication. Affected accounts with edit_other_timesheet or delete_other_timesheet permissions can enumerate sequential timesheet IDs and perform read, modify, or delete operations on all timesheets system-wide. The vulnerability was patched in version 2.56.0 by adding team-scoped permission checks.

Affected products

Kimai Kimai before 2.56.0

Identifiers

CVE-2026-80202
GHSA-9g2q-w3w2-vf7q

Timeline

2026-04-27: disclosed: GitHub security advisory GHSA-9g2q-w3w2-vf7q published
2026-04-27: patched: Fix released in version 2.56.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.