CVE-2026-80202: Kimai Authentication Bypass Vulnerability

CVE-2026-80202 Overview

CVE-2026-80202 is an authorization bypass vulnerability in Kimai, an open-source time-tracking application, affecting all versions before 2.56.0. The flaw resides in the TimesheetVoter::voteOnAttribute() method, which maps permissions only to own_timesheet or other_timesheet without enforcing team-membership checks. Any authenticated user holding ROLE_TEAMLEAD (or any role granting edit_other_timesheet or delete_other_timesheet) can read, modify, or permanently delete timesheets belonging to any user across the system via the API. Timesheet IDs are sequential integers, making enumeration trivial. The maintainers characterize this behavior as matching the documented permission model.

Critical Impact
Team leads can access, alter, and delete timesheet records for any user system-wide, regardless of team membership, enabling data tampering and destruction of billing records.

Affected Products

Kimai time-tracking application, all versions prior to 2.56.0
Deployments exposing the Kimai API to authenticated users with ROLE_TEAMLEAD
Multi-tenant Kimai instances relying on team boundaries for data isolation

Discovery Timeline

2026-08-26 - CVE-2026-80202 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80202

Vulnerability Analysis

The vulnerability is a broken access control issue classified under CWE-863: Incorrect Authorization. Kimai uses Symfony's voter mechanism to determine whether an authenticated user may perform an action on a timesheet. The TimesheetVoter::voteOnAttribute() implementation resolves each request into one of two permission buckets: own_timesheet for records owned by the caller, or other_timesheet for records owned by anyone else.

The voter grants access whenever the caller holds a permission such as view_other_timesheet, edit_other_timesheet, or delete_other_timesheet. It never checks whether the target timesheet's owner belongs to a team led by the caller. ROLE_TEAMLEAD accounts are granted these permissions by default, so a team lead can operate on the timesheets of users outside their own team.

Standard ROLE_USER accounts are correctly restricted to their own records.

Root Cause

The root cause is a missing scope check in the authorization decision. The voter conflates the capability to act on other users' timesheets with unlimited scope over all such timesheets. Team membership, which the product documentation implies as an isolation boundary, is not evaluated inside the voter.

Attack Vector

An authenticated attacker with ROLE_TEAMLEAD sends authenticated requests to the Kimai REST API endpoints for timesheet retrieval, modification, and deletion. Because timesheet identifiers are sequential integers, the attacker enumerates IDs directly and issues GET, PATCH, or DELETE calls against arbitrary records. No additional privileges, user interaction, or network position beyond API reachability are required.

Exploitation details are described in the GitHub Security Advisory GHSA-9g2q-w3w2-vf7q and the VulnCheck Advisory on Kimai Bypass.

Detection Methods for CVE-2026-80202

Indicators of Compromise

API requests from ROLE_TEAMLEAD accounts to /api/timesheets/{id} targeting sequential ID ranges outside their team scope
Unexpected PATCH or DELETE operations against timesheet records owned by users in other teams
Bulk enumeration patterns showing many GET /api/timesheets/{id} requests with incrementing integer IDs
Audit log entries showing timesheet modifications by team leads who do not manage the affected user

Detection Strategies

Correlate the acting user's team membership with the target timesheet's owner and alert when they do not match
Baseline typical API call volume per team lead and flag deviations consistent with ID enumeration
Monitor web server logs for high-rate sequential access to /api/timesheets/ endpoints

Monitoring Recommendations

Enable and centralize Kimai application and API access logs in a SIEM for long-term retention
Alert on any DELETE /api/timesheets/{id} operation performed by non-admin accounts
Track the ratio of other_timesheet to own_timesheet operations per user to identify outliers

How to Mitigate CVE-2026-80202

Immediate Actions Required

Upgrade Kimai to version 2.56.0 or later on all instances
Audit accounts holding ROLE_TEAMLEAD and revoke the role from users who do not require it
Review recent timesheet modifications and deletions for unauthorized changes and restore from backup where needed
Restrict network exposure of the Kimai API to trusted networks or authenticated VPN users

Patch Information

The issue is addressed in Kimai 2.56.0. Refer to the GitHub Security Advisory GHSA-9g2q-w3w2-vf7q for the fix commit and release notes. Note that the maintainers state this behavior matches the documented permission model, so administrators should validate that the updated behavior aligns with their operational expectations.

Workarounds

Remove edit_other_timesheet and delete_other_timesheet permissions from ROLE_TEAMLEAD until upgrade is possible
Create a custom role with only view_other_timesheet where write access to peer timesheets is not required
Enforce reverse-proxy access controls that restrict /api/timesheets/ endpoints to admin accounts pending patch deployment

bash

# Example: upgrade Kimai via composer to the fixed release
composer require kimai/kimai:^2.56.0
php bin/console kimai:update
php bin/console cache:clear --env=prod