{"schema_version":1,"title":"Kimai vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 35 vulnerabilities in Kimai: 0 in the last 7 days and 29 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52828, was published on 15 September 2026.","url":"https://junglewise.ai/threats/technologies/kimai","json_url":"https://junglewise.ai/threats/technologies/kimai.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/kimai","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":5,"all_time":35,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":17,"last_90_days":29,"last_365_days":35},"latest":[{"cve":"CVE-2026-52828","cvss":4,"epss":0.0047,"slug":"cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExpor","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:10.147+00:00","url":"https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export"},{"cve":"CVE-2026-52827","cvss":4,"epss":0.0058,"slug":"cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay","title":"Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before T","severity":"high","exploited":false,"published_at":"2026-09-15T11:17:09.993+00:00","url":"https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay"},{"cve":"CVE-2026-52826","cvss":4,"epss":0.0043,"slug":"cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints","title":"Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/cu","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:09.837+00:00","url":"https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints"},{"cve":"CVE-2026-52825","cvss":4,"epss":0.0045,"slug":"cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activitie","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:09.687+00:00","url":"https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis"},{"cve":"CVE-2026-52824","cvss":4,"epss":0.0133,"slug":"cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_thi","severity":"critical","exploited":false,"published_at":"2026-09-15T11:17:09.543+00:00","url":"https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image"},{"cve":"CVE-2026-52823","cvss":4,"epss":0.003,"slug":"cve-2026-52823-kimai-csrf-in-timesheet-stop-and-restart-api-endpoints","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/t","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:09.4+00:00","url":"https://junglewise.ai/threats/cve-2026-52823-kimai-csrf-in-timesheet-stop-and-restart-api-endpoints"},{"cve":"CVE-2026-52822","cvss":4,"epss":0.0047,"slug":"cve-2026-52822-kimai-improper-authorization-in-timesheet-restart-and-duplicate","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:09.25+00:00","url":"https://junglewise.ai/threats/cve-2026-52822-kimai-improper-authorization-in-timesheet-restart-and-duplicate"},{"cve":"CVE-2026-52821","cvss":4,"epss":0.0043,"slug":"cve-2026-52821-kimai-improper-authorization-in-activity-and-project-creation","title":"Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admi","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:09.107+00:00","url":"https://junglewise.ai/threats/cve-2026-52821-kimai-improper-authorization-in-activity-and-project-creation"},{"cve":"CVE-2026-52820","cvss":4,"epss":0.0045,"slug":"cve-2026-52820-kimai-timesheet-authorization-bypass-in-project-assignment","title":"Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-contro","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:08.957+00:00","url":"https://junglewise.ai/threats/cve-2026-52820-kimai-timesheet-authorization-bypass-in-project-assignment"},{"cve":"CVE-2026-52819","cvss":4,"epss":0.005,"slug":"cve-2026-52819-kimai-authorization-bypass-in-get-api-timesheets-api","title":"Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target id","severity":"medium","exploited":false,"published_at":"2026-09-15T11:17:08.8+00:00","url":"https://junglewise.ai/threats/cve-2026-52819-kimai-authorization-bypass-in-get-api-timesheets-api"},{"cve":"CVE-2026-49992","cvss":4,"epss":0.0022,"slug":"cve-2026-49992-kimai-csrf-in-team-creation-endpoints","title":"Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their","severity":"medium","exploited":false,"published_at":"2026-09-11T22:16:37.673+00:00","url":"https://junglewise.ai/threats/cve-2026-49992-kimai-csrf-in-team-creation-endpoints"},{"cve":"CVE-2026-49865","cvss":4,"epss":0.0035,"slug":"cve-2026-49865-kimai-ssrf-in-invoice-pdf-rendering-via-markdown-image-urls","title":"Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their inv","severity":"medium","exploited":false,"published_at":"2026-09-11T21:17:10.783+00:00","url":"https://junglewise.ai/threats/cve-2026-49865-kimai-ssrf-in-invoice-pdf-rendering-via-markdown-image-urls"},{"cve":"CVE-2026-84808","cvss":4.3,"epss":0.0031,"slug":"cve-2026-84808-kimai-rest-api-timesheet-authorization-bypass-in-activity-team","title":"Kimai REST API timesheet authorization bypass in activity-team access controls","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.87+00:00","url":"https://junglewise.ai/threats/cve-2026-84808-kimai-rest-api-timesheet-authorization-bypass-in-activity-team"},{"cve":"CVE-2026-84807","cvss":5.4,"epss":0.0025,"slug":"cve-2026-84807-kimai-improper-authorization-in-team-creation-endpoints","title":"Kimai improper authorization in team creation endpoints","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.733+00:00","url":"https://junglewise.ai/threats/cve-2026-84807-kimai-improper-authorization-in-team-creation-endpoints"},{"cve":"CVE-2026-84806","cvss":5.4,"epss":0.0024,"slug":"cve-2026-84806-kimai-improper-authorization-in-team-access-endpoints","title":"Kimai improper authorization in team access endpoints","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.593+00:00","url":"https://junglewise.ai/threats/cve-2026-84806-kimai-improper-authorization-in-team-access-endpoints"},{"cve":"CVE-2026-84805","cvss":4.3,"epss":0.0029,"slug":"cve-2026-84805-kimai-missing-authorization-in-work-contract-preferences-api","title":"Kimai missing authorization in work-contract preferences API","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.457+00:00","url":"https://junglewise.ai/threats/cve-2026-84805-kimai-missing-authorization-in-work-contract-preferences-api"},{"cve":"CVE-2026-84804","cvss":5.4,"epss":0.0033,"slug":"cve-2026-84804-kimai-authorization-bypass-in-team-activity-api","title":"Kimai authorization bypass in team activity API","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.32+00:00","url":"https://junglewise.ai/threats/cve-2026-84804-kimai-authorization-bypass-in-team-activity-api"},{"cve":"CVE-2026-80202","cvss":8.8,"epss":0.0045,"slug":"cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter","title":"Kimai authorization bypass in timesheet voter","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.98+00:00","url":"https://junglewise.ai/threats/cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter"},{"cve":"CVE-2026-80201","cvss":3.1,"epss":0.0026,"slug":"cve-2026-80201-kimai-twig-invoice-template-sandbox-escape-via-unblocked-user","title":"Kimai Twig invoice template sandbox escape via unblocked User methods","severity":"low","exploited":false,"published_at":"2026-08-26T05:18:27.83+00:00","url":"https://junglewise.ai/threats/cve-2026-80201-kimai-twig-invoice-template-sandbox-escape-via-unblocked-user"},{"cve":"CVE-2026-80200","cvss":4.7,"epss":0.0036,"slug":"cve-2026-80200-kimai-open-redirect-in-saml-authentication-handler","title":"Kimai open redirect in SAML authentication handler","severity":"medium","exploited":false,"published_at":"2026-08-26T05:18:27.68+00:00","url":"https://junglewise.ai/threats/cve-2026-80200-kimai-open-redirect-in-saml-authentication-handler"},{"cve":"CVE-2026-80199","cvss":3.7,"epss":0.0031,"slug":"cve-2026-80199-kimai-tokenauthenticator-username-enumeration-via-timing-oracle","title":"Kimai TokenAuthenticator username enumeration via timing oracle","severity":"low","exploited":false,"published_at":"2026-08-26T05:18:27.53+00:00","url":"https://junglewise.ai/threats/cve-2026-80199-kimai-tokenauthenticator-username-enumeration-via-timing-oracle"},{"cve":"CVE-2026-80198","cvss":7.5,"epss":0.0043,"slug":"cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates","title":"Kimai Twig config() function information disclosure in templates","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.38+00:00","url":"https://junglewise.ai/threats/cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates"},{"cve":"CVE-2026-80197","cvss":4.3,"epss":0.0026,"slug":"cve-2026-80197-kimai-improper-authorization-in-favorite-timesheet-endpoints","title":"Kimai improper authorization in favorite timesheet endpoints","severity":"medium","exploited":false,"published_at":"2026-08-26T05:18:27.23+00:00","url":"https://junglewise.ai/threats/cve-2026-80197-kimai-improper-authorization-in-favorite-timesheet-endpoints"},{"cve":"CVE-2026-80196","cvss":7.5,"epss":0.0054,"slug":"cve-2026-80196-kimai-authentication-bypass-in-password-reset-link","title":"Kimai authentication bypass in password reset link","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.083+00:00","url":"https://junglewise.ai/threats/cve-2026-80196-kimai-authentication-bypass-in-password-reset-link"},{"cve":"CVE-2026-80195","cvss":5.4,"epss":0.0036,"slug":"cve-2026-80195-kimai-team-update-api-improper-authorization","title":"Kimai team update API improper authorization","severity":"medium","exploited":false,"published_at":"2026-08-26T05:18:26.937+00:00","url":"https://junglewise.ai/threats/cve-2026-80195-kimai-team-update-api-improper-authorization"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":10},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-14","critical":1,"exploited":0,"vulnerabilities":10},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Kimai","slug":"kimai","vendor":{"name":"Kimai","slug":"kimai","url":"https://junglewise.ai/threats/vendors/kimai"},"aliases":[],"category":"web-application","homepage":"https://www.kimai.org/","repo_url":"https://github.com/kimai/kimai","description":"Kimai is an open-source time-tracking application designed for freelancers and companies to manage projects and generate invoices.","url":"https://junglewise.ai/threats/technologies/kimai"},"most_severe":[{"cve":"CVE-2026-52824","cvss":4,"epss":0.0133,"slug":"cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image","title":"Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_thi","severity":"critical","exploited":false,"published_at":"2026-09-15T11:17:09.543+00:00","url":"https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image"},{"cve":"CVE-2026-80193","cvss":8.8,"epss":0.0047,"slug":"cve-2026-80193-kimai-quickentry-authorization-bypass-in-timesheet-creation","title":"Kimai QuickEntry authorization bypass in timesheet creation","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:26.617+00:00","url":"https://junglewise.ai/threats/cve-2026-80193-kimai-quickentry-authorization-bypass-in-timesheet-creation"},{"cve":"CVE-2026-80202","cvss":8.8,"epss":0.0045,"slug":"cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter","title":"Kimai authorization bypass in timesheet voter","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.98+00:00","url":"https://junglewise.ai/threats/cve-2026-80202-kimai-authorization-bypass-in-timesheet-voter"},{"cve":"CVE-2026-80196","cvss":7.5,"epss":0.0054,"slug":"cve-2026-80196-kimai-authentication-bypass-in-password-reset-link","title":"Kimai authentication bypass in password reset link","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.083+00:00","url":"https://junglewise.ai/threats/cve-2026-80196-kimai-authentication-bypass-in-password-reset-link"},{"cve":"CVE-2026-80198","cvss":7.5,"epss":0.0043,"slug":"cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates","title":"Kimai Twig config() function information disclosure in templates","severity":"high","exploited":false,"published_at":"2026-08-26T05:18:27.38+00:00","url":"https://junglewise.ai/threats/cve-2026-80198-kimai-twig-config-function-information-disclosure-in-templates"},{"cve":"CVE-2026-52827","cvss":4,"epss":0.0058,"slug":"cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay","title":"Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before T","severity":"high","exploited":false,"published_at":"2026-09-15T11:17:09.993+00:00","url":"https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay"},{"cve":"CVE-2026-28685","cvss":6.5,"epss":0.0045,"slug":"cve-2026-28685-kimai-missing-authorization-in-api-invoice-endpoint","title":"Kimai missing authorization in API invoice endpoint","severity":"medium","exploited":false,"published_at":"2026-03-04T20:43:17+00:00","url":"https://junglewise.ai/threats/cve-2026-28685-kimai-missing-authorization-in-api-invoice-endpoint"},{"cve":"CVE-2026-42267","cvss":5.7,"epss":0.0033,"slug":"cve-2026-42267-kimai-formula-injection-in-xlsx-export-via-tag-names","title":"Kimai formula injection in XLSX export via tag names","severity":"medium","exploited":false,"published_at":"2026-05-08T04:16:20.533+00:00","url":"https://junglewise.ai/threats/cve-2026-42267-kimai-formula-injection-in-xlsx-export-via-tag-names"},{"cve":"CVE-2026-80195","cvss":5.4,"epss":0.0036,"slug":"cve-2026-80195-kimai-team-update-api-improper-authorization","title":"Kimai team update API improper authorization","severity":"medium","exploited":false,"published_at":"2026-08-26T05:18:26.937+00:00","url":"https://junglewise.ai/threats/cve-2026-80195-kimai-team-update-api-improper-authorization"},{"cve":"CVE-2026-84804","cvss":5.4,"epss":0.0033,"slug":"cve-2026-84804-kimai-authorization-bypass-in-team-activity-api","title":"Kimai authorization bypass in team activity API","severity":"medium","exploited":false,"published_at":"2026-09-02T12:17:17.32+00:00","url":"https://junglewise.ai/threats/cve-2026-84804-kimai-authorization-bypass-in-team-activity-api"}],"generated_at":"2026-09-26T20:07:00.238639+00:00"}