CVE-2026-52821: Kimai Time Tracking Privilege Escalation

CVE-2026-52821 Overview

CVE-2026-52821 is a broken access control vulnerability in Kimai, an open-source time tracking application. Versions prior to 2.57.0 fail to verify edit access on parent Project or Customer objects when handling requests to /en/admin/activity/create/{project} and /en/admin/project/create/{customer}. Any authenticated user holding the generic create_activity or create_project capability can attach new child objects to parents they do not own. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in Kimai 2.57.0.

Critical Impact
Authenticated users can pollute project and customer configurations by creating child records under unauthorized parents, influencing downstream time-entry, rate, reporting, and billing behavior.

Affected Products

Kimai time tracking application, all versions prior to 2.57.0
src/Controller/ActivityController.php preset-parent creation route
src/Controller/ProjectController.php preset-parent creation route

Discovery Timeline

2026-09-15 - CVE-2026-52821 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-52821

Vulnerability Analysis

Kimai exposes two administrative routes that allow creation of child business objects with a preset parent supplied in the URL path. The route /en/admin/activity/create/{project} accepts a project identifier and creates a new activity under it. The route /en/admin/project/create/{customer} accepts a customer identifier and creates a project under it.

Both routes enforce only the coarse capability check for create_activity or create_project. Neither route calls the object-level voter that verifies the requesting user has edit rights on the referenced parent. As a result, any user knowing or guessing a valid project.id or customer identifier can persist unauthorized child records.

The resulting data pollution propagates into time-entry association, hourly rate resolution, reporting rollups, and invoice generation. This turns an access control lapse into a downstream integrity problem affecting billing accuracy.

Root Cause

The controllers in src/Controller/ActivityController.php and src/Controller/ProjectController.php rely on a generic action capability instead of an object-scoped authorization check. The preset-parent creation logic accepts the parent reference from the URL without confirming the current user has edit permission on that parent instance.

Attack Vector

An authenticated low-privileged user issues a GET or POST request to the preset-parent creation endpoints while supplying an identifier for a Project or Customer they do not own. The application persists the new Activity or Project under that parent, bypassing intended tenant or team boundaries.

javascript

      */
     activateSelectPickerByElement(node)
     {
+        // TODO cannot update tom-select to >= 2.6.0 due to https://github.com/orchidjs/tom-select/pull/993#issuecomment-4489286080
         let plugins = ['change_listener'];
 
         const isMultiple = node.multiple !== undefined && node.multiple === true;

Source: GitHub commit 976d38e — part of the 2.57.0 release changeset that ships the authorization fix.

Detection Methods for CVE-2026-52821

Indicators of Compromise

Web server access log entries for GET or POST requests to /en/admin/activity/create/{project} or /en/admin/project/create/{customer} originating from users without edit rights on the referenced parent.
New Activity or Project records whose creator does not match the owner or team assigned to the parent Project or Customer.
Unexpected changes in reporting totals, invoice line items, or rate assignments tied to newly created child objects.

Detection Strategies

Review Kimai audit logs and database records for child objects created by users outside the parent's assigned team.
Correlate application authentication events with administrative creation endpoints to flag privilege mismatches.
Query the activities and projects tables for records created within the exposure window and cross-check ownership against parent access lists.

Monitoring Recommendations

Enable verbose HTTP request logging on the Kimai reverse proxy for all /en/admin/activity/create/* and /en/admin/project/create/* paths.
Alert on non-admin accounts hitting preset-parent creation endpoints.
Track Kimai release advisories and dependency updates through the Kimai security overview.

How to Mitigate CVE-2026-52821

Immediate Actions Required

Upgrade Kimai to version 2.57.0 or later, which enforces edit-access verification on the parent Project or Customer.
Audit existing Activity and Project records created before the upgrade for parent-child ownership mismatches.
Review and tighten user capability assignments so create_activity and create_project are granted only to trusted roles.

Patch Information

The fix ships in Kimai 2.57.0 via pull request #5929. Refer to the GitHub Security Advisory GHSA-3q6q-26vg-v97x, the GitHub Pull Request #5929, and the GitHub Release 2.57.0 for the full changeset.

Workarounds

Restrict the create_activity and create_project capabilities to administrative roles until the upgrade is applied.
Place a reverse-proxy rule that blocks or authenticates access to /en/admin/activity/create/* and /en/admin/project/create/* for non-admin users.
Monitor and manually review new Activity and Project records against parent ownership until the patched version is deployed.

bash

# Example: upgrade Kimai to the patched release using Docker
docker pull kimai/kimai2:2.57.0
docker compose down
docker compose up -d

# Verify running version
docker exec -it kimai bin/console kimai:version