CVE-2026-52826: Kimai Time Tracking Auth Bypass Vulnerability

CVE-2026-52826 Overview

CVE-2026-52826 is a broken access control vulnerability [CWE-285] in Kimai, an open-source time tracking application. Versions prior to 2.57.0 fail to validate ownership relationships between parent entities and their rate records. The affected endpoints handle project, customer, and activity rate assignments through admin routes. An authenticated user with edit rights on one parent object can attach a rate record from an unrelated project, customer, or activity. This allows unauthorized modification of billing configuration stored in the kimai2_projects_rates, kimai2_customers_rates, and kimai2_activities_rates tables. The maintainers resolved the issue in Kimai 2.57.0.

Critical Impact
Authenticated users can persist unauthorized billing rate changes by pairing an authorized parent object with a rate record belonging to a different project, customer, or activity.

Affected Products

Kimai time tracking application versions prior to 2.57.0
Admin endpoints under /en/admin/project/{id}/rate/{rate}
Admin endpoints under /en/admin/customer/{id}/rate/{rate} and /en/admin/activity/{id}/rate/{rate}

Discovery Timeline

2026-09-15 - CVE-2026-52826 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52826

Vulnerability Analysis

The flaw is a missing authorization check [CWE-285] in Kimai's rate management endpoints. GET or POST requests to the three admin rate routes resolve two identifiers independently: the parent identifier (project, customer, or activity) and the rate identifier. The authorization layer verifies that the requester can edit the parent object. It does not verify that the referenced ProjectRate, CustomerRate, or ActivityRate record belongs to that parent. An authenticated attacker with edit rights on one parent can therefore submit a rate identifier from an entity they do not control. The application accepts the pairing and writes changes to the corresponding rates table, altering billing configuration outside the attacker's authorization scope.

Root Cause

The controller logic decouples parent-object authorization from child-record validation. Rate records are looked up by primary key alone rather than by a composite lookup that enforces the parent-child relationship. This is a classic insecure direct object reference pattern where the ownership constraint is assumed but never enforced at the persistence layer.

Attack Vector

Exploitation requires a valid authenticated session with edit rights on at least one project, customer, or activity. The attacker crafts a request to a rate endpoint, substituting the {rate} path segment with a rate identifier tied to a parent they cannot access. The request executes over the network with low complexity and no user interaction. Modified billing rates persist to the database and affect downstream invoicing.

// Vulnerable request pattern (illustrative)
POST /en/admin/project/{authorizedProjectId}/rate/{unauthorizedRateId}
// Server updates the rate record without validating that
// unauthorizedRateId.project_id == authorizedProjectId

See the GitHub Security Advisory GHSA-2xgg-2x8h-8xw4 and the fix commit for full technical detail.

Detection Methods for CVE-2026-52826

Indicators of Compromise

Unexpected rows or modifications in the kimai2_projects_rates, kimai2_customers_rates, or kimai2_activities_rates tables that do not match the parent entity referenced in application logs.
Web server access log entries showing POST or GET requests to /en/admin/{project|customer|activity}/{id}/rate/{rate} where the {rate} identifier does not belong to {id}.
Billing or invoice discrepancies that trace back to rate records altered by users without direct access to the affected parent entity.

Detection Strategies

Audit rate tables against parent-child relationships and flag rate records whose foreign key does not match the parent referenced in recent controller requests.
Correlate authenticated user identifiers with modifications to rate records outside their assigned scope of projects, customers, or activities.
Review Symfony application logs for administrative rate route activity and compare against user role assignments.

Monitoring Recommendations

Enable application-level audit logging for all writes to the three rate tables and forward events to a centralized log platform.
Alert on any HTTP 200 response to the affected admin rate endpoints where the responding user is not the owner of the referenced rate record.
Track invoice generation jobs and flag rates that were modified within a short window before invoice creation.

How to Mitigate CVE-2026-52826

Immediate Actions Required

Upgrade Kimai to version 2.57.0 or later, which enforces parent-child validation on rate endpoints.
Review historical activity in kimai2_projects_rates, kimai2_customers_rates, and kimai2_activities_rates for unauthorized modifications and restore correct values where needed.
Rotate administrative sessions and audit user role assignments for accounts with edit rights on projects, customers, or activities.

Patch Information

The vulnerability is fixed in Kimai 2.57.0. The upstream patch is available in GitHub Pull Request #5929 and the corresponding fix commit. Release artifacts are published at the Kimai 2.57.0 release page. Additional guidance is provided in the Kimai security update advisory.

Workarounds

Restrict access to the affected admin rate endpoints at the reverse proxy or web application firewall layer until the upgrade is applied.
Limit edit rights on projects, customers, and activities to a minimal set of trusted administrators to reduce the pool of accounts that can exercise the flaw.
Increase monitoring on rate tables and invoicing pipelines to detect unauthorized modifications quickly.

bash

# Upgrade Kimai to the patched release
git fetch --tags
git checkout 2.57.0
composer install --no-dev --optimize-autoloader
bin/console kimai:update