CVE-2026-52820 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
Authenticated users can bypass team access controls to assign timesheets to unauthorized projects and read associated metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52820?
CVE-2026-52820 is a medium-severity missing authorization vulnerability in kimai, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.
Weakness: CWE-639
Which versions are affected by CVE-2026-52820?
2 open source packages ship an affected version, including kimai/kimai.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.57.0 |
kimai/kimai Packagist | All versions | 2.57.0 |
How do I fix CVE-2026-52820?
Upgrade kimai/kimai to 2.57.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-52820 being exploited?
There is no known exploitation of CVE-2026-52820 in the wild and no public exploit code.
Sources
Also known as GHSA-vrr2-g9gh-c3jc.