CVE-2026-80193: Kimai before 2.62.0 Authorization Bypass via QuickEntry
Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users who have both view_other_timesheet and edit_other_timesheet permissions can exploit the QuickEntry form to create timesheet records for team members. The issue does not apply to unauthenticated users based on the available information.
Are default Kimai permissions affected?
The available information identifies the required permissions but does not state whether they are assigned in a default Kimai configuration. Review roles that grant both view_other_timesheet and edit_other_timesheet permissions.
What should be done if an immediate upgrade is not possible?
Restrict or remove the combination of view_other_timesheet and edit_other_timesheet permissions from users who should not be able to create timesheets for others. Limit access to the QuickEntry workflow for affected users where possible.
How can administrators check for potential misuse?
Review timesheet records created through QuickEntry for entries assigned to team members by users holding both view_other_timesheet and edit_other_timesheet permissions. The provided information does not identify a specific audit-log event or other definitive indicator.