CVE-2026-52822: Kimai Auth Bypass Vulnerability

CVE-2026-52822 Overview

Kimai, an open-source time tracking application, contains a broken access control flaw prior to version 2.58.0. The PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and web duplicate workflow endpoints allow a user to derive new time records from historical timesheets even after administrators revoke access to the underlying project or activity. The flaw resides in TimesheetVoter, which evaluates the own-timesheet permission before current team access and does not verify the user's current team access to the referenced project and activity. An old entry acts as a persistent capability, letting the user corrupt budgets, statistics, reports, and invoices after an administrative revocation.

Critical Impact
Authenticated users can create new timesheet records against projects and activities they no longer have permission to access, undermining budget controls and financial reporting integrity.

Affected Products

Kimai time tracking application prior to version 2.58.0
Kimai REST API endpoints PATCH /api/timesheets/{id}/restart and PATCH /api/timesheets/{id}/duplicate
Kimai web-based timesheet duplicate workflow

Discovery Timeline

2026-09-15 - CVE-2026-52822 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52822

Vulnerability Analysis

The vulnerability is a broken access control issue [CWE-285] in Kimai's TimesheetVoter authorization component. When a user invokes the restart or duplicate operations on a timesheet they previously created, the voter grants access based on ownership of the historical record rather than the user's current membership in the project or activity teams. The canStart() routine validates that the referenced project and activity are visible objects but omits a check for the user's active team access. As a result, an authenticated user can produce new timesheets tied to projects and activities from which an administrator has revoked their access.

The downstream effect is data integrity corruption. New records flow into aggregated budgets, statistics, reports, and generated invoices under a project the user is no longer authorized to bill against. Because the API accepts these calls without further checks, the operation is straightforward to script and repeat.

Root Cause

The ordering of authorization checks in TimesheetVoter is the root cause. The voter evaluates the own-timesheet permission first and short-circuits before verifying current team access to the referenced project and activity. The canStart() object visibility check is insufficient because visibility does not imply current team membership.

Attack Vector

An authenticated Kimai user calls PATCH /api/timesheets/{id}/restart or PATCH /api/timesheets/{id}/duplicate against a timesheet they previously owned. The web duplicate workflow provides the same path through the browser UI. No elevated privileges are required beyond an authenticated session, and no user interaction is needed beyond invoking the endpoint.

No public exploit code is available for this issue. Technical detail is provided by the Kimai Security Advisory GHSA-c6w6-57jj-62vh and the corresponding GitHub Pull Request #5952.

Detection Methods for CVE-2026-52822

Indicators of Compromise

New timesheet entries associated with projects or activities from which the acting user's team access was previously revoked.
Repeated PATCH requests to /api/timesheets/{id}/restart or /api/timesheets/{id}/duplicate where {id} references historical records predating a team membership change.
Unexpected changes in project budget consumption, invoice totals, or reporting statistics without corresponding new access grants.

Detection Strategies

Correlate Kimai audit logs of user team membership changes with subsequent timesheet creation events tied to the same projects.
Review HTTP access logs for PATCH /api/timesheets/*/restart and PATCH /api/timesheets/*/duplicate calls issued by users whose project or activity assignments recently changed.
Compare the acting user's current team access against the project and activity referenced by each newly created timesheet.

Monitoring Recommendations

Enable Kimai application and web server request logging with user attribution and endpoint path retention.
Alert on any timesheet creation where the record's project or activity is not present in the acting user's current team assignments.
Track EPSS score movement for CVE-2026-52822 and vendor advisory updates on the Kimai Security Announcement page.

How to Mitigate CVE-2026-52822

Immediate Actions Required

Upgrade all Kimai instances to version 2.58.0 or later, which contains the authorization fix.
Audit timesheet records created after known team membership revocations and reconcile budgets, reports, and invoices as needed.
Restrict network exposure of the Kimai API to trusted networks until patching is complete.

Patch Information

The fix is included in Kimai release 2.58.0 via GitHub Pull Request #5952 and commit 31a8f88. The patch modifies TimesheetVoter so that current team access to the referenced project and activity is verified alongside timesheet ownership. Full details are available in the GitHub Security Advisory GHSA-c6w6-57jj-62vh.

Workarounds

No official workaround is documented; upgrading to 2.58.0 is the supported remediation.
If an immediate upgrade is not possible, restrict access to the restart and duplicate API endpoints and web workflow at the reverse proxy layer for users whose team assignments have recently changed.
Manually invalidate or delete historical timesheets belonging to users who have lost access to the associated project or activity, so those records cannot serve as a persistent capability.

bash

# Example reverse-proxy restriction (NGINX) blocking the vulnerable endpoints
# until the Kimai instance is upgraded to 2.58.0 or later
location ~ ^/api/timesheets/[0-9]+/(restart|duplicate)$ {
    return 403;
}