CVE-2026-80193 Overview
CVE-2026-80193 is a missing authorization vulnerability [CWE-862] in Kimai, an open-source time-tracking application. Versions before 2.62.0 fail to validate the create_other_timesheet permission inside the QuickEntry controller. Authenticated users holding only view_other_timesheet and edit_other_timesheet permissions can submit the QuickEntry form to create timesheet entries on behalf of other team members. The flaw bypasses authorization checks that Kimai enforces in other timesheet code paths.
Critical Impact
Authenticated users can forge timesheet records for other team members, corrupting billing data, project reporting, and payroll integrity.
Affected Products
- Kimai time-tracking application
- All Kimai releases prior to version 2.62.0
- Self-hosted and containerized Kimai deployments
Discovery Timeline
- 2026-08-26 - CVE-2026-80193 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80193
Vulnerability Analysis
Kimai enforces distinct permissions for viewing, editing, and creating timesheets that belong to other users. The create_other_timesheet permission gates the ability to insert a new timesheet record on behalf of another team member. The QuickEntry controller, which handles rapid timesheet submissions from the Kimai dashboard, does not check this permission before persisting records. Instead, it accepts any authenticated user who possesses the read and edit permissions for other users' timesheets.
An attacker with view_other_timesheet and edit_other_timesheet roles can therefore forge new entries against any user they can view. Because Kimai timesheets typically drive invoicing, payroll, and project cost allocation, forged entries directly impact financial and operational integrity. The affected flow bypasses authorization logic that other controllers correctly enforce, making this a classic broken access control defect rather than a design flaw across the entire product.
Root Cause
The QuickEntry controller omits the permission voter call for create_other_timesheet when processing form submissions. Authorization is enforced elsewhere in the codebase, so the QuickEntry endpoint diverges from the intended access control model. The fix in version 2.62.0 adds the missing permission check to the controller.
Attack Vector
Exploitation requires an authenticated Kimai account with view_other_timesheet and edit_other_timesheet permissions. The attacker submits a crafted QuickEntry form referencing another user's identifier, and the backend accepts the record without verifying create authorization. No user interaction from the target is required. Refer to the GitHub Security Advisory GHSA-2w7f-x78f-89q2 and the VulnCheck Advisory for Kimai for additional technical detail.
Detection Methods for CVE-2026-80193
Indicators of Compromise
- Timesheet records where the created_by user differs from the assigned user without a corresponding administrative action in audit logs.
- POST requests to QuickEntry endpoints from accounts that lack the create_other_timesheet role.
- Unexpected timesheet entries appearing for team members outside their normal working hours or projects.
Detection Strategies
- Review Kimai application logs for QuickEntry form submissions and correlate the submitter's assigned permissions against the target user of each entry.
- Query the Kimai database for timesheets created by users who do not hold the create_other_timesheet permission in the current role assignments.
- Compare timesheet creation patterns before and after the deployment window to identify anomalous bulk entries.
Monitoring Recommendations
- Enable verbose access logging on the Kimai web tier and forward events to a centralized log platform for retention and search.
- Alert on discrepancies between the authenticated session user and the user_id field written to the kimai2_timesheet table.
- Track HTTP requests targeting QuickEntry routes and baseline normal submission volumes per account.
How to Mitigate CVE-2026-80193
Immediate Actions Required
- Upgrade Kimai to version 2.62.0 or later on all production and staging instances.
- Audit existing timesheet records created since the vulnerable version was deployed and reconcile against expected user activity.
- Review role assignments and remove view_other_timesheet or edit_other_timesheet permissions from accounts that do not require them.
Patch Information
The Kimai maintainers addressed the missing authorization check in release 2.62.0. The patch adds the create_other_timesheet permission check to the QuickEntry controller so that submissions are rejected when the caller lacks create authority. Details are published in the GitHub Security Advisory GHSA-2w7f-x78f-89q2.
Workarounds
- Temporarily disable the QuickEntry feature in the Kimai UI configuration until the upgrade is applied.
- Restrict view_other_timesheet and edit_other_timesheet permissions to a minimal set of trusted administrators.
- Place the Kimai application behind a reverse proxy that blocks POST requests to QuickEntry routes for non-privileged user groups.
# Upgrade Kimai via Composer to the fixed release
composer require kimai/kimai:^2.62.0
bin/console kimai:update
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
