CVE-2026-80197: Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.57.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kimai user with low-level privileges can exploit it. Administrative privileges are not required.
What access does an attacker need to manipulate another user's favorites?
The attacker needs a valid authenticated session and the identifier of a target user's timesheet entry. They can then use the favorite add or remove endpoints to alter that user's bookmark state.
Is this limited to a specific feature?
Yes. The reported authorization flaw affects the endpoints used to add and remove favorite timesheet entries. The described impact is unauthorized modification of other users' favorite lists.
Which versions are affected?
Kimai versions before 2.57.0 are affected. Upgrading to 2.57.0 or later addresses the affected version range.