CVE-2026-52819: Kimai Time Tracking Auth Bypass Vulnerability

CVE-2026-52819 Overview

Kimai is an open-source time tracking application used by teams to record work hours, projects, and billable rates. A broken access control flaw [CWE-863] in the GET /api/timesheets list endpoint allows a user with the view_other_timesheet permission to retrieve timesheet records belonging to users outside their team scope. The endpoint accepts user and users[] identifiers without applying access_user checks or verifying that a ROLE_TEAMLEAD caller actually leads a team containing each requested user. The issue is fixed in Kimai version 2.57.0.

Critical Impact
A team lead can enumerate another user's timesheet descriptions, timing data, tags, rate, and internalRate through the list endpoint, even though the single-record endpoint GET /api/timesheets/{id} correctly denies access.

Affected Products

Kimai time tracking application prior to version 2.57.0
Deployments exposing the /api/timesheets REST endpoint
Instances where users hold ROLE_TEAMLEAD with the view_other_timesheet permission

Discovery Timeline

2026-09-15 - CVE-2026-52819 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52819

Vulnerability Analysis

The flaw resides in TimesheetController::cgetAction(), which handles list requests to the /api/timesheets endpoint. When a caller supplies the user or users[] query parameters, the controller resolves the identifiers and appends the users directly to the query builder. The controller does not invoke the access_user authorization check, and it does not confirm that a ROLE_TEAMLEAD requester leads a team that includes each target user.

Project and customer filters do not compensate for this gap. Records tied to unscoped projects, or projects that share ordinary team membership, remain visible in the response. As a result, a team lead can retrieve timesheet metadata for users they do not manage, including sensitive rate information.

The inconsistency is significant because the sibling endpoint GET /api/timesheets/{id} enforces authorization through TimesheetVoter and correctly denies the same access.

Root Cause

The controller performs input resolution without a matching authorization decision. Authorization is inconsistently applied between the list endpoint and the single-record endpoint, producing a classic authorization bypass pattern classified under [CWE-863] Incorrect Authorization.

Attack Vector

An authenticated user with ROLE_TEAMLEAD and the view_other_timesheet permission issues a GET /api/timesheets request supplying user or users[] identifiers of users outside their team. The API returns descriptions, timing data, tags, rate, and internalRate fields for those unauthorized users.

The fix landed in commit 976d38e8a4485a1c923ee7b5841849e91a06e849 as part of Kimai Release 2.57.0 and Pull Request #5929. See the GitHub Security Advisory GHSA-4m8q-55qv-9pwp for the vendor writeup.

Detection Methods for CVE-2026-52819

Indicators of Compromise

Requests to /api/timesheets containing user= or users[]= parameters referencing user IDs outside the caller's team
API responses that return timesheet records with rate or internalRate fields to accounts that are not designated managers of the listed users
Anomalous spikes in GET /api/timesheets volume from a single ROLE_TEAMLEAD account

Detection Strategies

Review Kimai application and web server access logs for /api/timesheets calls that specify user or users[] parameters, and correlate the caller's team assignments with the requested user IDs
Alert when a single API token or session queries timesheet data for many distinct user IDs in a short window
Compare responses returned by the list endpoint against TimesheetVoter decisions on the equivalent single-record endpoint to surface inconsistencies

Monitoring Recommendations

Enable verbose HTTP access logging on the Kimai reverse proxy and retain query strings
Ingest API access logs into a centralized SIEM or data lake and build detections around cross-team timesheet enumeration
Track authentication events for ROLE_TEAMLEAD accounts and baseline their normal API usage

How to Mitigate CVE-2026-52819

Immediate Actions Required

Upgrade Kimai to version 2.57.0 or later, which contains the fix in commit 976d38e8a4485a1c923ee7b5841849e91a06e849
Audit which accounts hold ROLE_TEAMLEAD and the view_other_timesheet permission, and revoke where not required
Review historical /api/timesheets access logs to identify prior unauthorized enumeration of other users' timesheet data

Patch Information

The upstream fix is delivered in Kimai 2.57.0. The patch adds proper authorization enforcement in TimesheetController::cgetAction() so that user and users[] targets are validated against access_user and the caller's team leadership. Refer to the Kimai Security Advisory GHSA-4m8q-55qv-9pwp and the GitHub Commit for details.

Workarounds

Restrict network access to the /api/timesheets endpoint using a reverse proxy or web application firewall until patching is complete
Temporarily remove the view_other_timesheet permission or ROLE_TEAMLEAD assignment from non-essential users
Rotate any API tokens issued to team leads after upgrading to invalidate credentials that may have been used for enumeration

javascript

// Patch snippet from Kimai 2.57.0 (assets/js/forms/KimaiFormSelect.js)
// Source: https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849
activateSelectPickerByElement(node)
{
    // TODO cannot update tom-select to >= 2.6.0 due to https://github.com/orchidjs/tom-select/pull/993#issuecomment-4489286080
    let plugins = ['change_listener'];

    const isMultiple = node.multiple !== undefined && node.multiple === true;
}