CVE-2026-41498 Kimai: Team API Missing Object-Level Authorization
Attackers with edit_team permission can modify any team due to missing object-level authorization checks in the Kimai time tracking application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41498?
CVE-2026-41498 is a low-severity missing authorization vulnerability in kimai, published on 8 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-41498?
2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.54.0 |
kimai/kimai Packagist | All versions | 2.54.0 |
Products include Kimai Kimai.
How do I fix CVE-2026-41498?
Upgrade kimai/kimai to 2.54.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41498 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41498 exists.
Other vulnerabilities in kimai
- CVE-2020-19825 Cross-site Scripting in kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2
- CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
- CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
Sources
Also known as GHSA-jv9x-w4gm-hwcm.