CVE-2026-52828 kimai CVE debrief

Who should care

Kimai administrators and team leads with create_export permissions should assess exposure and prioritize patching to version 2.58.0. This includes reviewing current version and permissions, verifying affected scope, and restricting create_export_template permissions if necessary. Team leads and administrators must ensure export templates are not modified to alter exports used by other users and administrators.

Why it matters

CVE-2026-52828 allows team leads in Kimai to create or modify export templates due to inadequate permission checks, potentially altering exports used by other users. Assess exposure, verify version, and prioritize patching to version 2.58.0.

• Team leads can create or modify export templates, potentially altering exports used by other users.
• This may lead to unauthorized changes in export columns, renderer, format, and output.
• Verification of current version and permissions is necessary to prevent potential issues.
• Patching to version 2.58.0 is recommended to fix the vulnerability.

Technical summary

The ExportController::createExportTemplate() and ExportController::editExportTemplate() methods in Kimai versions prior to 2.58.0 only require the create_export permission, which is received by ROLE_TEAMLEAD by default. However, these methods should also require the create_export_template permission. This allows team leads to create or modify global ExportTemplate records, potentially altering exports used by other users and administrators.

Defensive priority

Assess exposure and verify version for Kimai installations; prioritize patching for team leads with create_export permissions.

Recommended defensive actions

• Assess Kimai installation exposure, especially for team leads with create_export permissions.
• Verify current version and prioritize patching to version 2.58.0 if necessary.
• Review and restrict create_export_template permissions for team leads if not already done.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix in version 2.58.0. GitHub references provide additional context. The ExportController::createExportTemplate() and ExportController::editExportTemplate() methods in Kimai versions prior to 2.58.0 only require the create_export permission, which is received by ROLE_TEAMLEAD by default. However, these methods should also require the create_export_template permission. Team leads can create or modify global ExportTemplate records, potentially altering exports. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.