CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
Attackers can force logged-in users to stop or restart timesheets via GET requests, corrupting time records and billing data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52823?
CVE-2026-52823 is a medium-severity vulnerability in kimai, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.
Weakness: CWE-352
Which versions are affected by CVE-2026-52823?
2 open source packages ship an affected version, including kimai/kimai.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.58.0 |
kimai/kimai Packagist | All versions | 2.58.0 |
How do I fix CVE-2026-52823?
Upgrade kimai/kimai to 2.58.0 or later.
Is CVE-2026-52823 being exploited?
There is no known exploitation of CVE-2026-52823 in the wild and no public exploit code.
Sources
Also known as GHSA-r8vr-m544-qh4h.