CVE-2026-52828: Kimai Time Tracking Auth Bypass Vulnerability

CVE-2026-52828 Overview

CVE-2026-52828 is a missing authorization vulnerability in Kimai, an open-source time tracking application. Versions prior to 2.58.0 contain flawed permission checks in the ExportController::createExportTemplate() and ExportController::editExportTemplate() methods. Both methods inherit only the class-level create_export permission, which the ROLE_TEAMLEAD role receives by default. They omit the create_export_template permission required by the corresponding API routes and user interface. A team lead can therefore create or modify global ExportTemplate records that are marked available to all users. Kimai released a fix in version 2.58.0.

Critical Impact
Users with the ROLE_TEAMLEAD role can create or edit global export templates, altering export columns, renderer, format, and output relied upon by other users and administrators.

Affected Products

Kimai time tracking application, all versions prior to 2.58.0
Deployments where ROLE_TEAMLEAD is assigned to non-administrator users
Instances exposing the export template web and API routes

Discovery Timeline

2026-09-15 - CVE-2026-52828 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-52828

Vulnerability Analysis

The flaw is a missing authorization issue classified under [CWE-862]. Kimai enforces access control through Symfony security annotations declared at the controller class level. The ExportController class declares the create_export permission, which the ROLE_TEAMLEAD role receives by default. Two action methods that manage export templates, createExportTemplate() and editExportTemplate(), inherit only this class-level check. They do not declare the stricter create_export_template permission that is expected by the API routes and user interface for template management. As a result, the effective authorization boundary for template management collapses to the permission a team lead already holds.

Root Cause

The root cause is inconsistent permission enforcement between the controller methods and the route configuration. The API routes and user interface assume that create_export_template is required to reach template creation and editing endpoints. The controller methods do not re-check this permission, so any authenticated user with create_export can invoke them. This is a classic broken access control pattern where a permission gate is defined in one layer but not enforced in the handler.

Attack Vector

An authenticated user holding ROLE_TEAMLEAD sends HTTP requests to the export template creation or edit routes. Because the controller only requires create_export, the request is accepted. The attacker can then create a new global ExportTemplate or modify an existing one. Modifying a global template changes the columns, renderer, format, and output for exports generated by other users and administrators. This can be used to remove sensitive columns, alter output formats to break downstream automation, or introduce content that is later processed by administrators.

Code-level exploitation details are not published in the advisory. Refer to the Kimai Security Advisory GHSA-rw46-qg69-vg6h and the GitHub Pull Request #5952 for the corrective changes.

Detection Methods for CVE-2026-52828

Indicators of Compromise

HTTP requests from ROLE_TEAMLEAD accounts to export template creation or edit routes handled by ExportController::createExportTemplate() and ExportController::editExportTemplate().
New or modified ExportTemplate database records marked as globally available that were not created by an administrator.
Unexpected changes to export columns, renderer, format, or output fields on existing global templates.

Detection Strategies

Review Kimai application and web server logs for POST or PUT requests to export template endpoints originating from non-administrator accounts.
Query the Kimai database for ExportTemplate rows and correlate created_by or modified_by fields against expected administrator identities.
Compare current export template definitions to a known-good baseline captured before upgrade or after patching to 2.58.0.

Monitoring Recommendations

Enable audit logging for all administrative actions in Kimai, including export template CRUD operations.
Alert on any change to global export templates by accounts without administrator role membership.
Track role assignments and flag privilege changes that grant ROLE_TEAMLEAD to users who do not require it.

How to Mitigate CVE-2026-52828

Immediate Actions Required

Upgrade Kimai to version 2.58.0 or later, which enforces the create_export_template permission on the affected controller methods.
Review the list of accounts holding ROLE_TEAMLEAD and remove the role from users who do not require export management responsibilities.
Audit existing global ExportTemplate records and revert any unauthorized modifications identified during review.

Patch Information

The fix is included in Kimai 2.58.0. See the GitHub Release 2.58.0, the GitHub Commit Details, and the GitHub Security Advisory GHSA-rw46-qg69-vg6h. The patch adds the create_export_template permission requirement to the template creation and editing methods, aligning the controller with the route and user interface expectations.

The following excerpt from the release also hardens the Docker entrypoint against a known default APP_SECRET, shipped alongside the 2.58.0 release:

bash

function ensureAppSecret() {
  # GHSA-jr9p-4h4j-6c58
  # Make sure the container never runs with the publicly-known default APP_SECRET.
  # If the user provided their own value (via -e APP_SECRET=...) it is kept untouched.
  # Otherwise a unique secret is generated once and persisted below var/data.
  { set +x; } 2>/dev/null

  local SECRET_FILE=/opt/kimai/var/data/.appsecret
  local ENV_LOCAL=/opt/kimai/.env.local

  rm -f "$ENV_LOCAL"

  if [ -n "$APP_SECRET" ] && [ "$APP_SECRET" != "change_this_to_something_unique" ]; then
    set -x
    return
  fi
}
# Source: https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601

Workarounds

Restrict the ROLE_TEAMLEAD assignment to trusted users until the upgrade to 2.58.0 is completed.
Restrict network access to the Kimai export template routes at the reverse proxy or web application firewall layer for non-administrator sessions.
Monitor and manually review global ExportTemplate changes until the patched version is deployed.