These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-52828 is a vulnerability in Kimai, an open-source time tracking application. Prior to version 2.58.0, the ExportController::createExportTemplate() and ExportController::editExportTemplate() methods only inherit the class-level create_export permission, which is received by ROLE_TEAMLEAD by default. However, these methods require the create_export_template permission, as specified by the API route [truncated]
CVE-2026-52826 is a vulnerability in Kimai, an open-source time tracking application. An authenticated user can pair a rate record from an unauthorized project, customer, or activity with a parent object they can edit, persisting changes to billing configuration. This issue allows unauthorized access to billing configurations in Kimai deployments. Defenders responsible for Kimai deployments should assess [truncated]
CVE-2026-52825 is a vulnerability in Kimai, an open-source time tracking application. A teamlead can add users or activities outside the teamlead's manageable scope to an editable team, bypassing the narrower choices enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType(). This issue allows unauthorized access and potential security risks. It is fixed in version 2.58.0. Defenders should [truncated]
CVE-2026-52823 is a vulnerability in Kimai, an open-source time tracking application. The vulnerability allows a remote attacker to cause a logged-in user to perform unauthorized actions on their timesheets, such as stopping a running timesheet or restarting a historical entry, without the user's consent. This can lead to corrupted time records, billing, reports, approvals, and audits. The issue is fixed [truncated]
CVE-2026-52822 is a vulnerability in Kimai, an open-source time tracking application. The issue allows users to create new time records under an unauthorized project and activity after their access has been revoked, potentially corrupting budgets, statistics, reports, and invoices. This was fixed in version 2.58.0. The vulnerability arises from TimesheetVoter evaluating the own-timesheet permission before [truncated]
CVE-2026-52820 is a vulnerability in Kimai, an open-source time tracking application. The issue allows an authenticated user with edit_own_timesheet privileges to assign a timesheet to a project outside their teams, persist unauthorized project attribution, and retrieve project and customer metadata. This is fixed in version 2.57.0. The vulnerability arises from inadequate validation of user-controlled pr [truncated]
CVE-2026-52819 is a vulnerability in Kimai, an open-source time tracking application. The vulnerability allows a team lead to retrieve timesheets of other users, including descriptions, timing data, tags, rate, and internal rate, without proper access control. This issue arises from the TimesheetController::cgetAction() method adding resolved users directly to the query, bypassing access_user verification [truncated]
CVE-2026-49992 is an authenticated cross-site request forgery issue in Kimai, a time tracking application, affecting versions prior to 2.58.0. The vulnerability allows an attacker to trick a logged-in user with required permissions into visiting a malicious page, causing unauthorized changes to team, teamlead, and object-binding relationships. This issue arises from the application's default team creation [truncated]
CVE-2026-49865 is a server-side request forgery vulnerability in Kimai, an open-source time tracking application. Versions prior to 2.58.0 contain the vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax. This all [truncated]
Kimai before version 2.65.0 has an authorization bypass vulnerability that allows authenticated users with edit_team permission to revoke team access to activities, projects, and customers via API endpoints without the required permissions_activity check. This issue has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability affects Kimai deployments where team access is managed throug [truncated]
The CVE-2026-80195 record describes a business logic / improper authorization vulnerability in Kimai before 2.63.0. The team update API endpoint (PATCH /api/teams/{id}) removes existing team members before validating the submitted replacement member list. This allows an authenticated team lead to submit a malformed members payload, bypassing the dedicated member-removal endpoint's protection against remov [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T05:18:26.780Z and has not been modified since then. The ProjectViewController export route in Kimai before 2.64.0 lacks proper authorization, allowing authenticated users with limited permissions to access sensitive project data exports. This vulnerability enables any authenticated user, includin [truncated]
Kimai before version 2.62.0 is vulnerable to an authorization bypass via the QuickEntry controller. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members, bypassing authorization checks enforced elsewhere. This vulnerability impacts Kimai installations where users have limited permissions, as they can create timesheets for team mem [truncated]
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(). This allows any authenticated user with ROLE_TEAMLEAD to read, modify, and permanently delete timesheets belonging to any user system-wide via the API. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. The issue is characterized by maintainers as matc [truncated]
CVE-2026-80201 debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T05:18:27.830Z and has not been modified since then. The vulnerability affects Kimai versions before 2.53.0, allowing admins with template creation permissions to leak hashed API tokens by calling getApiToken() and getPlainApiToken() methods in Twig invoice templates. To mitigate this vulnerability, verif [truncated]
CVE-2026-80200 is an open redirect vulnerability in Kimai before 2.53.0. The vulnerability exists in the SAML authentication success handler, which accepts unvalidated RelayState POST parameters as redirect destinations. This allows attackers with IdP access to supply malicious RelayState values, redirecting authenticated users to attacker-controlled URLs for credential theft or phishing attacks. Administ [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T05:18:27.530Z and has not been modified since then. The Kimai application, prior to version 2.54.0, contains a timing oracle vulnerability in the TokenAuthenticator. This vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring response time differences when the pa [truncated]
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users. The CVE [truncated]
CVE-2026-80197 is an improper authorization vulnerability in Kimai before 2.57.0. Authenticated users can manipulate other users' favorite timesheets by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges. This vulnerability allows attackers to add or remove timesheet entries from another user's favorite list, potentially leading to unauth [truncated]
CVE-2026-80196 is an authentication bypass vulnerability in Kimai versions before 2.58.0. The vulnerability arises because password reset links remain valid after a user's password has been changed, allowing attackers who intercept or cache these links to log in as the user up to two additional times within a one-hour window. This issue is rated HIGH with a CVSS score of 8.7. The CVE record was published [truncated]