kimai vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20251
4. 202634

Newest CVEs

• CVE-2026-52827

  Kimai: Two-factor authentication bypass on the Kimai API

  kimai · kimai

  High7.1
• CVE-2026-52822

  Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

  kimai · kimai

  Medium5.3
• CVE-2026-52828

  Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

  kimai · kimai

  Medium5.3
• CVE-2026-52826

  Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

  kimai · kimai

  Medium5.3
• CVE-2026-52823

  Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

  kimai · kimai

  Medium5.3
• CVE-2026-52824

  Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

  kimai · kimai

  Critical9.1
• CVE-2026-52825

  Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

  kimai · kimai

  Medium5.3
• CVE-2026-52821

  Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

  kimai · kimai

  Medium5.3
• CVE-2026-52820

  Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

  kimai · kimai

  Medium5.3
• CVE-2026-52819

  Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

  kimai · kimai

  Medium6.3