CVE-2026-49992 Overview
CVE-2026-49992 is an authenticated cross-site request forgery (CSRF) vulnerability in Kimai, an open-source time tracking application. Versions prior to 2.58.0 expose team creation shortcuts for projects, customers, and activities through GET routes. These endpoints create or reuse a Team, add the current user as teamlead, and bind the target object to that team without CSRF protection. An attacker who lures a logged-in user with sufficient permissions to a malicious page can trigger unauthorized modifications to team membership, teamlead assignment, and object-binding relationships. Version 2.58.0 patches the issue [CWE-352].
Critical Impact
Authenticated users visiting attacker-controlled pages can be forced to alter authorization structures, including team leadership and object bindings, without their consent.
Affected Products
- Kimai time tracking application, versions prior to 2.58.0
- Default team creation shortcuts for projects, customers, and activities
- Deployments where privileged users browse untrusted content while authenticated
Discovery Timeline
- 2026-09-11 - CVE-2026-49992 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-49992
Vulnerability Analysis
The vulnerability affects Kimai's team creation shortcut endpoints for three object types: projects, customers, and activities. Each shortcut is reachable via an HTTP GET request. Invoking the endpoint creates a new Team or reuses an existing one, assigns the requesting user as teamlead, and binds the referenced object to that team.
Because the routes are GET-based and lack anti-CSRF tokens, any embedded resource such as an <img> tag, iframe, or auto-submitting form can cause a victim's browser to invoke them silently. The state-changing operations execute under the victim's authenticated session and permission scope.
The advisory characterizes this as a real authorization-structure modification issue rather than a cosmetic UI shortcut. Attackers can manipulate team relationships that govern access boundaries within the application.
Root Cause
The root cause is a design flaw in which state-changing operations are exposed through HTTP GET methods without CSRF token validation. The endpoints violate the safe-method contract of HTTP by mutating server-side authorization data on GET requests.
Attack Vector
Exploitation requires an authenticated Kimai user with permission to create teams and bind objects. The attacker hosts a page containing a resource reference to the vulnerable endpoint. When the victim loads the page while logged into Kimai, the browser transmits session cookies with the request, and the server processes it as a legitimate action.
For implementation-level details, refer to the GitHub Security Advisory and the Kimai Security Advisory.
Detection Methods for CVE-2026-49992
Indicators of Compromise
- Web server access logs showing GET requests to team creation shortcut routes originating from Referer headers outside the Kimai deployment.
- Newly created Team records with unexpected teamlead assignments that do not match normal administrative workflow.
- Object bindings between projects, customers, or activities and teams that were not initiated through the Kimai UI by an authorized administrator.
Detection Strategies
- Audit application database records for team creation timestamps that correlate with user browsing sessions rather than administrative actions.
- Correlate Referer and Origin request headers on team-related endpoints against an allowlist of trusted internal hosts.
- Review Kimai audit trails for team membership and teamlead changes performed by users who typically do not manage teams.
Monitoring Recommendations
- Enable verbose HTTP access logging for all Kimai routes and retain logs for post-incident analysis.
- Alert on any state-changing operations invoked via GET requests that mutate team or authorization data.
- Monitor for repeated team creation attempts from a single user session over a short interval.
How to Mitigate CVE-2026-49992
Immediate Actions Required
- Upgrade Kimai to version 2.58.0 or later, which contains the official fix.
- Inventory all team, teamlead, and object-binding records created before the upgrade and validate them against expected administrative activity.
- Restrict the team_lead permission and related team management privileges to a minimum set of trusted accounts.
Patch Information
Version 2.58.0 of Kimai patches the CSRF issue in the default team creation shortcuts for projects, customers, and activities. Consult the Kimai Security Advisory and the GitHub Security Advisory GHSA-pgcc-vfmc-7cw5 for release notes and upgrade guidance.
Workarounds
- Place Kimai behind a reverse proxy or web application firewall rule that blocks GET requests to the affected team shortcut endpoints until the upgrade is applied.
- Instruct privileged users to log out of Kimai when browsing untrusted content and to use separate browser profiles for administrative tasks.
- Enforce a strict SameSite=Strict cookie policy on the Kimai session cookie to reduce cross-site request exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
