CVE-2026-80202 kimai CVE debrief

Who should care

Administrators and users of Kimai installations, especially those with ROLE_TEAMLEAD users, should verify and restrict permissions to prevent system-wide timesheet access. This includes reviewing current team membership checks and ensuring that ROLE_TEAMLEAD permissions are appropriately limited to prevent unauthorized access to timesheets across the system. Additionally, implementing compensating controls such as monitoring for suspicious activity can help mitigate potential risks until the update is applied. Users with ROLE_USER accounts are correctly restricted and do not need to take additional action beyond standard security practices.

Technical summary

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(). This allows any authenticated user with ROLE_TEAMLEAD to read, modify, and permanently delete timesheets belonging to any user system-wide via the API. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. The issue is characterized by maintainers as matching the documented permission model.

Defensive priority

Authenticated users with ROLE_TEAMLEAD can read, modify, and delete timesheets system-wide; verify team membership checks and restrict ROLE_TEAMLEAD permissions.

Recommended defensive actions

• Verify team membership checks in TimesheetVoter::voteOnAttribute()
• Restrict ROLE_TEAMLEAD permissions to prevent system-wide timesheet access
• Implement compensating controls to monitor and limit API access
• Inventory and update Kimai installations to version 2.56.0 or later
• Monitor for suspicious timesheet modifications and deletions

Evidence notes

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(). Any authenticated user with ROLE_TEAMLEAD can read, modify, and permanently delete timesheets system-wide via the API. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.