CVE-2026-52825: Kimai Time Tracking Auth Bypass Vulnerability

CVE-2026-52825 Overview

Kimai is an open-source time tracking application used by teams to log billable work. CVE-2026-52825 is a broken access control vulnerability [CWE-285] affecting Kimai versions prior to 2.58.0. The flaw resides in two API endpoints: POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId}. Both endpoints verify that the caller can edit the referenced Team, but neither validates access_user on the referenced User nor view access on the referenced Activity. A teamlead can attach users and activities outside their manageable scope to any team they can edit, bypassing form-level restrictions enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType().

Critical Impact

Authenticated teamleads can add out-of-scope users and activities to editable teams, corrupting downstream authorization, visibility, reporting, and workflow logic.

Affected Products

• Kimai time tracking application, all versions prior to 2.58.0
• Deployments exposing the /api/teams/{id}/members/{userId} endpoint
• Deployments exposing the /api/teams/{id}/activities/{activityId} endpoint

Discovery Timeline

• 2026-09-15 - CVE-2026-52825 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52825

Vulnerability Analysis

The vulnerability is a broken authorization check in Kimai's REST API. Two write endpoints associate secondary entities with a Team resource. The controller logic confirms the caller holds edit rights on the target Team but stops there. It does not evaluate whether the caller has access_user on the User being added or view access on the Activity being linked.

The web UI enforces these scoping rules through TeamEditForm and the query builder returned by UserRepository::getQueryBuilderForFormType(). The API bypasses those filters entirely, exposing the raw entity relationship endpoints without equivalent guardrails.

Once the association is written to the database, downstream authorization logic trusts it. RolePermissionManager::checkTeamAccessActivity() and related team-scoped checks treat the injected membership as legitimate, extending visibility into reporting and workflow features the teamlead should not reach.

Root Cause

The root cause is missing authorization [CWE-285] on the referenced sub-resources. The controller authorizes the primary resource (Team) but omits scope checks on the User and Activity identifiers passed in the URL path.

Attack Vector

An authenticated user with teamlead privileges on any editable team can issue a POST request to either endpoint, referencing a userId or activityId outside their manageable scope. The API accepts the request and persists the relationship. The attacker inherits downstream permissions granted through that team association.

# Vulnerable endpoint pattern - requires authenticated teamlead session
POST /api/teams/{id}/members/{userId}
POST /api/teams/{id}/activities/{activityId}

See the Kimai Security Announcement and GitHub Security Advisory GHSA-xv4r-4885-gwpg for full technical details.

Detection Methods for CVE-2026-52825

Indicators of Compromise

• Unexpected entries in team membership tables linking users to teams the teamlead should not administer.
• Activity-to-team associations that reference activities outside the teamlead's project scope.
• Reporting or workflow access events attributed to users who were recently added via the API rather than the UI.

Detection Strategies

• Review web server and application logs for POST requests to /api/teams/{id}/members/{userId} and /api/teams/{id}/activities/{activityId}, correlating the authenticated principal against their expected scope.
• Audit the Kimai database for team memberships and activity assignments created outside of standard admin workflows.
• Alert on API calls from teamlead accounts that reference user or activity identifiers not present in their prior interaction history.

Monitoring Recommendations

• Enable verbose audit logging on Kimai API traffic and forward it to a centralized log store for retention and query.
• Baseline normal teamlead activity so anomalous membership modifications become visible in dashboards.
• Track version metadata from Kimai instances to confirm all deployments are running 2.58.0 or later.

How to Mitigate CVE-2026-52825

Immediate Actions Required

• Upgrade Kimai to version 2.58.0 or later, published as GitHub Release 2.58.0.
• Review current team memberships and activity assignments for entries created by teamlead accounts and revert any that violate scope.
• Rotate credentials and API tokens for teamlead accounts if unauthorized associations are found.

Patch Information

The fix ships in Kimai 2.58.0. The corrective changes are tracked in GitHub Pull Request #5952 and merged via commit 31a8f88. The release adds sub-resource authorization checks so the API mirrors the scoping enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType().

Workarounds

• Restrict the teamlead role to trusted operators until the upgrade is applied.
• Block or gate the two affected endpoints at a reverse proxy or API gateway for non-administrator sessions.
• Increase audit review frequency for team and activity changes during the exposure window.

# Example: block the vulnerable endpoints at an nginx reverse proxy
location ~ ^/api/teams/[^/]+/(members|activities)/[^/]+$ {
    if ($request_method = POST) {
        return 403;
    }
    proxy_pass http://kimai_backend;
}