CVE-2026-80197: Kimai Authorization Bypass Vulnerability

CVE-2026-80197 Overview

Kimai versions before 2.57.0 contain an improper authorization vulnerability [CWE-639] in the favorite timesheet add and remove endpoints. Authenticated users can manipulate other users' bookmarks by referencing another user's timesheet identifier. The endpoints fail to verify that the referenced timesheet belongs to the requesting user. Attackers exploit this flaw to add or remove entries from any user's favorites list without administrative privileges. The vulnerability enables cross-user business-state tampering across a shared Kimai instance.

Critical Impact
Any authenticated Kimai user can tamper with other users' favorite timesheet bookmarks by submitting crafted requests referencing arbitrary timesheet IDs, corrupting workflow state for every account on the instance.

Affected Products

Kimai time-tracking application versions prior to 2.57.0
Self-hosted Kimai deployments exposing the favorite timesheet endpoints
Multi-tenant Kimai instances with more than one authenticated user

Discovery Timeline

2026-08-26 - CVE-2026-80197 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80197

Vulnerability Analysis

The flaw resides in the API endpoints that add and remove favorite timesheet entries. These endpoints accept a timesheet identifier from the authenticated user but omit an ownership check tying that identifier to the requesting account. An attacker enumerates or guesses valid timesheet IDs and issues favorite add or remove requests against them. The server processes the request against the target user's bookmark list rather than the caller's own. This class of flaw is an Insecure Direct Object Reference, tracked as CWE-639. Successful abuse does not require elevated roles, only a valid authenticated session on the target instance.

Root Cause

The favorite endpoints trust the timesheet identifier supplied in the request without correlating it to the session user. Authorization logic verifies that the caller is authenticated but does not enforce object-level ownership. As a result the affected controllers operate on records outside the caller's permission boundary.

Attack Vector

Exploitation is remote and authenticated. An attacker with any low-privilege account issues HTTP requests to the favorite add and remove endpoints while supplying another user's timesheet identifier. The action succeeds and mutates the victim's favorites collection. Because the flaw acts on business-state records shared across users, impact scales with the number of active accounts on the instance. Refer to the GitHub Security Advisory GHSA-j5mc-p8qg-39j7 and the VulnCheck Advisory for Kimai for full technical detail.

Detection Methods for CVE-2026-80197

Indicators of Compromise

Application audit log entries showing favorite add or remove actions where the acting user does not own the referenced timesheet record.
Sudden bulk changes to a user's favorites list without a corresponding session action from that user.
Sequential requests to the favorite endpoints iterating through timesheet IDs from a single authenticated session.

Detection Strategies

Correlate application logs to compare the user_id on each favorite request with the owner_id of the referenced timesheet and alert on mismatches.
Implement server-side telemetry that emits an authorization event whenever cross-user object access is attempted on the favorite endpoints.
Baseline normal favorite activity per account and flag deviations that indicate enumeration of foreign timesheet identifiers.

Monitoring Recommendations

Enable verbose access logging on the Kimai reverse proxy and retain request paths, method, session identifier, and body parameters for the favorite endpoints.
Monitor for high-frequency POST or DELETE requests targeting favorite add and remove routes from any single authenticated principal.
Review database change logs on the favorites table for entries whose owning user does not match the acting user recorded in the application session log.

How to Mitigate CVE-2026-80197

Immediate Actions Required

Upgrade Kimai to version 2.57.0 or later on all production and staging instances.
Audit the favorites table for entries created or removed by accounts other than the record owner and restore expected state.
Rotate API tokens issued to Kimai users if abuse of the favorite endpoints is suspected.

Patch Information

The maintainers addressed the improper authorization defect in Kimai 2.57.0. The fix enforces ownership validation on the favorite timesheet add and remove endpoints so that operations only succeed when the referenced timesheet belongs to the authenticated user. Release notes and patch details are available in the GitHub Security Advisory GHSA-j5mc-p8qg-39j7.

Workarounds

Restrict Kimai access to trusted authenticated users only until the upgrade to 2.57.0 is completed.
Place the application behind an authenticating reverse proxy that logs and rate-limits requests to the favorite endpoints.
Temporarily disable or block the favorite add and remove routes at the web server layer if the feature is not business-critical.

bash

# Configuration example - upgrade Kimai to the fixed release
cd /var/www/kimai
git fetch --tags
git checkout 2.57.0
composer install --no-dev --optimize-autoloader
bin/console kimai:update