CVE-2026-28685 Kimai: API invoice endpoint missing customer-level access control (IDOR)

Medium 6.5 Published 6 Mar 2026 Updated 9 Mar 2026

Team leads can read all invoices regardless of customer assignment due to missing customer-level access control checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-28685?

CVE-2026-28685 is a medium-severity missing authorization vulnerability in kimai, published on 6 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.

Weakness: CWE-285

Which versions are affected by CVE-2026-28685?

2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.

Package	Affected	Fixed in
`kimai/kimai` Packagist	All versions	`2.51.0`
`kimai/kimai` Packagist	All versions	`2.51.0`

Products include Kimai Kimai.

How do I fix CVE-2026-28685?

Upgrade kimai/kimai to 2.51.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28685 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28685 exists.

Sources

Also known as GHSA-v33r-r6h2-8wr7.