CVE-2026-52822 (GCVE-0-2026-52822)

Vulnerability from cvelistv5 – Published: 2026-09-15 10:44 – Updated: 2026-09-15 13:52

Title

Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Summary

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user's current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activity, corrupting budgets, statistics, reports, and invoices after an administrative revocation. This issue is fixed in version 2.58.0.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:25 UTC

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/kimai/kimai/security/advisorie…	x_refsource_CONFIRM
https://github.com/kimai/kimai/pull/5952	x_refsource_MISC
https://github.com/kimai/kimai/commit/31a8f887a5c…	x_refsource_MISC
https://github.com/kimai/kimai/releases/tag/2.58.0	x_refsource_MISC
https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kimai	kimai	Affected: < 2.58.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:25:08.014876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:52:17.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kimai",
          "vendor": "kimai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.58.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user\u0027s access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user\u0027s current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activity, corrupting budgets, statistics, reports, and invoices after an administrative revocation. This issue is fixed in version 2.58.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T10:44:08.637Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh"
        },
        {
          "name": "https://github.com/kimai/kimai/pull/5952",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kimai/kimai/pull/5952"
        },
        {
          "name": "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"
        },
        {
          "name": "https://github.com/kimai/kimai/releases/tag/2.58.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kimai/kimai/releases/tag/2.58.0"
        },
        {
          "name": "https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh"
        }
      ],
      "source": {
        "advisory": "GHSA-c6w6-57jj-62vh",
        "discovery": "UNKNOWN"
      },
      "title": "Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52822",
    "datePublished": "2026-09-15T10:44:08.637Z",
    "dateReserved": "2026-06-08T18:11:06.661Z",
    "dateUpdated": "2026-09-15T13:52:17.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52822",
      "date": "2026-09-15",
      "epss": "0.00387",
      "percentile": "0.32237"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-52822\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T11:17:09.250\",\"lastModified\":\"2026-09-15T14:16:56.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user\u0027s access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user\u0027s current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activity, corrupting budgets, statistics, reports, and invoices after an administrative revocation. This issue is fixed in version 2.58.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kimai\",\"product\":\"kimai\",\"versions\":[{\"version\":\"\u003c 2.58.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T13:25:08.014876Z\",\"id\":\"CVE-2026-52822\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kimai/kimai/pull/5952\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kimai/kimai/releases/tag/2.58.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

FKIE_CVE-2026-52822

Vulnerability from fkie_nvd - Published: 2026-09-15 11:17 - Updated: 2026-09-15 11:17

Severity

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601
	security-advisories@github.com	https://github.com/kimai/kimai/pull/5952
	security-advisories@github.com	https://github.com/kimai/kimai/releases/tag/2.58.0
	security-advisories@github.com	https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh
	security-advisories@github.com	https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kimai",
          "vendor": "kimai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.58.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user\u0027s access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user\u0027s current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activity, corrupting budgets, statistics, reports, and invoices after an administrative revocation. This issue is fixed in version 2.58.0."
    }
  ],
  "id": "CVE-2026-52822",
  "lastModified": "2026-09-15T11:17:09.250",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-15T11:17:09.250",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kimai/kimai/pull/5952"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kimai/kimai/releases/tag/2.58.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-C6W6-57JJ-62VH

Vulnerability from github – Published: 2026-07-14 00:04 – Updated: 2026-07-14 00:04

Summary

Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Details

Summary

Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet restart and duplicate workflows. After a user loses access to a project, the user can still derive a new timesheet from one of their historical entries and create a new record under that now-unauthorized project and activity combination.

This is a permission revocation bypass with persistent write impact. The issue affects both restart and duplicate, which trust ownership of an old timesheet more than the user's current access to the underlying project, activity, and customer.

Details

The issue affects the following operations:

PATCH /api/timesheets/{id}/restart
PATCH /api/timesheets/{id}/duplicate

The root cause is that authorization gives too much weight to the fact that the original timesheet belongs to the current user. In src/Voter/TimesheetVoter.php, the *_own_timesheet branch is evaluated before team-based access checks.

The restart/duplicate capability check also verifies only object visibility, not whether the current user still has team-based access to the referenced objects.

In src/API/TimesheetController.php, the restart flow copies the historical project and activity into a new candidate timesheet.

The duplicate flow similarly clones the historical record and saves it.

In src/Timesheet/TimesheetService.php, creation of a new running entry still relies on isGranted('start', $timesheet).

For historical entries that belong to the current user, this logic can still succeed through the *_own_timesheet branch even after project access has been revoked. As a result, normal creation pages correctly stop offering the revoked project, but restart and duplicate can still create new records under it.

The same weakness also affects the Web duplicate flow because the UI path ultimately calls the same save logic in src/Controller/TimesheetAbstractController.php:

A PoC was provided, but removed for security reasons.

Impact

This vulnerability allows a user to keep writing new time entries into a project after project access has been revoked. That undermines administrative access-control changes and can pollute project time tracking, budget calculations, statistics, reports, and invoicing workflows.

Because both restart and duplicate can reuse historical project/activity bindings, old timesheet records effectively become reusable capability tokens that survive later access-control changes. This is not a UI artifact or a caching problem: new database rows are persisted after revocation.

Solution

The metoid TimesheetVoter::canStart() now checks team access for project and activity. This verification is used for new timesheets and also for the duplication and restart workflows.

See https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh for more information.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.57.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "kimai/kimai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.58.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52822"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-14T00:04:26Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nKimai 2.56.0 contains an authenticated authorization bypass in the timesheet `restart` and `duplicate` workflows. After a user loses access to a project, the user can still derive a new timesheet from one of their historical entries and create a new record under that now-unauthorized project and activity combination.\n\nThis is a permission revocation bypass with persistent write impact. The issue affects both `restart` and `duplicate`, which trust ownership of an old timesheet more than the user\u0027s current access to the underlying project, activity, and customer.\n\n### Details\n\nThe issue affects the following operations:\n\n- `PATCH /api/timesheets/{id}/restart`\n- `PATCH /api/timesheets/{id}/duplicate`\n\nThe root cause is that authorization gives too much weight to the fact that the original timesheet belongs to the current user. In `src/Voter/TimesheetVoter.php`, the `*_own_timesheet` branch is evaluated before team-based access checks.\n\nThe restart/duplicate capability check also verifies only object visibility, not whether the current user still has team-based access to the referenced objects. \n\nIn `src/API/TimesheetController.php`, the restart flow copies the historical `project` and `activity` into a new candidate timesheet.\n\nThe duplicate flow similarly clones the historical record and saves it.\n\nIn `src/Timesheet/TimesheetService.php`, creation of a new running entry still relies on `isGranted(\u0027start\u0027, $timesheet)`.\n\nFor historical entries that belong to the current user, this logic can still succeed through the `*_own_timesheet` branch even after project access has been revoked. As a result, normal creation pages correctly stop offering the revoked project, but `restart` and `duplicate` can still create new records under it.\n\nThe same weakness also affects the Web duplicate flow because the UI path ultimately calls the same save logic in `src/Controller/TimesheetAbstractController.php`:\n\n*A PoC was provided, but removed for security reasons.*\n\n### Impact\n\nThis vulnerability allows a user to keep writing new time entries into a project after project access has been revoked. That undermines administrative access-control changes and can pollute project time tracking, budget calculations, statistics, reports, and invoicing workflows.\n\nBecause both `restart` and `duplicate` can reuse historical project/activity bindings, old timesheet records effectively become reusable capability tokens that survive later access-control changes. This is not a UI artifact or a caching problem: new database rows are persisted after revocation.\n\n# Solution\n\nThe metoid `TimesheetVoter::canStart()` now checks team access for project and activity. This verification is used for new timesheets and also for the `duplication` and `restart` workflows.\n\nSee [https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh](https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh) for more information.",
  "id": "GHSA-c6w6-57jj-62vh",
  "modified": "2026-07-14T00:04:26Z",
  "published": "2026-07-14T00:04:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kimai/kimai"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-52822 (GCVE-0-2026-52822)

FKIE_CVE-2026-52822

GHSA-C6W6-57JJ-62VH

Summary

Details

Impact

Solution

Tags

Sightings

Nomenclature