CVE-2026-52823 kimai CVE debrief

Who should care

Defenders responsible for Kimai instances should assess exposure and apply the fix, as the vulnerability can lead to corrupted time records and billing. Users of Kimai should also be aware of the vulnerability and take steps to protect themselves.

Why it matters

CVE-2026-52823 is a vulnerability in Kimai that allows remote attackers to perform unauthorized actions on timesheets, leading to corrupted time records and billing. Defenders should prioritize verifying exposure and applying the fix.

• Corruption of time records and billing due to unauthorized actions.
• Potential disruption of business operations due to corrupted data.
• Need for defenders to verify exposure and apply the fix.
• Possible impact on audits and approvals due to corrupted data.

Technical summary

The vulnerability is caused by the TimesheetController exposing GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. This allows a remote attacker to cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability can lead to corrupted time records and billing.

Recommended defensive actions

• Verify exposure by checking if the Kimai instance is vulnerable to the described attacks.
• Apply the fix by upgrading to version 2.58.0 or later.
• Monitor timesheets and billing for any suspicious activity.
• Implement additional security measures, such as request-forgery defenses, to prevent similar attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the TimesheetController exposing GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.