CVE-2026-52820: Kimai Time Tracking Auth Bypass Vulnerability

CVE-2026-52820 Overview

CVE-2026-52820 is a broken access control vulnerability in Kimai, an open-source time tracking application. Versions prior to 2.57.0 allow authenticated users to assign owned timesheets to projects outside their team membership. The flaw resides in ProjectRepository::getQueryBuilderForFormType(), which places a user-controlled project identifier in an unconditional OR branch that bypasses team access criteria. Any user holding the edit_own_timesheet permission can exploit the issue via PATCH /api/timesheets/{id} or POST /api/timesheets. The attacker can then retrieve project and customer metadata using GET /api/timesheets/{id}?full=true. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated low-privileged users can assign timesheets to unauthorized projects and read protected project and customer metadata across team boundaries.

Affected Products

Kimai time tracking application versions prior to 2.57.0
Deployments exposing the /api/timesheets REST endpoints
Instances with users granted the edit_own_timesheet permission

Discovery Timeline

2026-09-15 - CVE-2026-52820 published to the National Vulnerability Database
2026-09-15 - Last updated in the NVD database
Fix released - Kimai version 2.57.0 addresses the vulnerability, tracked under GHSA-vrr2-g9gh-c3jc

Technical Details for CVE-2026-52820

Vulnerability Analysis

The vulnerability stems from improper authorization logic in Kimai's project selection query builder. When a user submits a timesheet through TimesheetApiEditForm and FormTrait, the supplied project identifier flows into ProjectRepository::getQueryBuilderForFormType(). That method appends the identifier to an unconditional OR branch in the query, effectively short-circuiting the team access filter that would normally constrain project visibility. An authenticated user with edit_own_timesheet can therefore reference any project ID in the system, regardless of team membership. Beyond persisting unauthorized project attribution, the attacker can then call GET /api/timesheets/{id}?full=true to enumerate metadata for projects and customers that should remain out of scope.

Root Cause

The root cause is an authorization bypass through a user-controlled key ([CWE-639]). The query builder trusts the client-supplied project identifier and merges it into the result set without verifying that the target project belongs to a team the acting user can access. The team access predicate is bypassed at the SQL level rather than enforced as a mandatory filter.

Attack Vector

Exploitation requires network access to the Kimai API and valid credentials for any account with edit_own_timesheet. The attacker issues a PATCH or POST request to /api/timesheets with a project field pointing to an out-of-team project ID. The server accepts the assignment, persists the change, and subsequently returns the associated project and customer data on read requests using the full=true parameter.

javascript

// Patch excerpt from assets/js/forms/KimaiFormSelect.js in Kimai 2.57.0
     activateSelectPickerByElement(node)
     {
+        // TODO cannot update tom-select to >= 2.6.0 due to https://github.com/orchidjs/tom-select/pull/993#issuecomment-4489286080
         let plugins = ['change_listener'];
 
         const isMultiple = node.multiple !== undefined && node.multiple === true;
// Source: https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849

The server-side fix adds validation in TimesheetTeamAccessValidator, which now checks changed project and activity associations against the acting user's current team access before persisting the timesheet.

Detection Methods for CVE-2026-52820

Indicators of Compromise

Timesheet records whose project_id references a project the owning user is not a member of through any team assignment.
API access logs showing PATCH /api/timesheets/{id} or POST /api/timesheets requests followed by GET /api/timesheets/{id}?full=true from the same low-privileged account.
Audit trail entries showing project attribution changes to projects the user has never legitimately interacted with.

Detection Strategies

Query the Kimai database to identify timesheets where the owning user lacks team-based access to the associated project.
Correlate API request patterns for accounts that only hold edit_own_timesheet but access metadata across multiple project or customer scopes.
Review web server and application logs for enumeration behavior against sequential timesheet IDs combined with the full=true parameter.

Monitoring Recommendations

Enable verbose API request logging on /api/timesheets endpoints and forward the logs to a centralized analytics platform.
Baseline normal project assignment patterns per user role and alert on cross-team assignments.
Monitor for anomalous read volume against GET /api/timesheets/{id}?full=true from non-administrative accounts.

How to Mitigate CVE-2026-52820

Immediate Actions Required

Upgrade Kimai to version 2.57.0 or later without delay. See the GitHub Release Notes for 2.57.0.
Audit existing timesheet records for cross-team project assignments made prior to patching and correct any unauthorized attributions.
Review and, where possible, tighten the assignment of the edit_own_timesheet permission to limit the exploitable user population.

Patch Information

The fix is delivered in Kimai 2.57.0 via the changes referenced in Pull Request #5929 and the associated security commit 976d38e. TimesheetTeamAccessValidator now validates any changed project or activity associations against the acting user's current team access. Additional context is available in the Kimai security announcement.

Workarounds

If immediate upgrade is not feasible, restrict network access to the /api/timesheets endpoints using a reverse proxy or WAF rule to limit exposure.
Temporarily revoke the edit_own_timesheet permission from non-essential user roles until the patch can be applied.
Manually review timesheet writes on a scheduled basis and revert any assignments that reference projects outside the user's team scope.

bash

# Upgrade Kimai to the patched release (Docker deployment example)
docker pull kimai/kimai2:apache-2.57.0
docker compose down
docker compose up -d

# Verify the running version
docker exec -it kimai bin/console kimai:version