CVE-2026-52822 kimai CVE debrief

Who should care

Defenders managing Kimai deployments, especially those with multiple users and projects, should assess exposure and apply the patch. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders need to prioritize patching to version 2.58.0 to prevent exploitation and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-52822 allows users to create unauthorized time records in Kimai, potentially impacting budgets and reports. Defenders should verify exposure, prioritize patching, and monitor for suspicious activity.

• Potential corruption of budgets, statistics, reports, and invoices due to unauthorized time record creation.
• Verification of historical timesheet access and potential data corruption is required.
• Defenders need to prioritize patching to version 2.58.0 to prevent exploitation.

Technical summary

The vulnerability in Kimai allows users to derive a new record from an owned historical timesheet after their access to its project or activity has been revoked. This is due to TimesheetVoter evaluating the own-timesheet permission before current team access, and its canStart() logic validating object visibility but not verifying the user's current team access to the referenced project and activity.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, focusing on users with historical timesheet access.

Recommended defensive actions

• Verify if the current version of Kimai is prior to 2.58.0 and patch to 2.58.0 if necessary.
• Review historical timesheets for unauthorized access and potential data corruption.
• Monitor for suspicious activity related to time record creation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional verification is needed to confirm affected deployments. Defenders should review historical timesheets for unauthorized access and potential data corruption. The vulnerability allows users to derive a new record from an owned historical timesheet after their access to its project or activity has been revoked.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.