CVE-2026-80202: Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD (or a role holding editothertimesheet/deleteothertimesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLEUSER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.56.0Patch Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
Event History
Frequently Asked Questions
Which accounts can access timesheets outside their teams?
Authenticated users with ROLE_TEAMLEAD, or any role granted edit_other_timesheet or delete_other_timesheet, can read, modify, or permanently delete timesheets belonging to any user. Accounts limited to ROLE_USER are correctly restricted.
What does an attacker need to exploit this issue?
The attacker needs a valid authenticated account with the affected role or permissions and access to the API. Timesheet IDs are sequential integers, making target records trivially enumerable.
Are installations using the default ROLE_USER permissions affected?
ROLE_USER accounts are correctly restricted. Exposure depends on whether users have ROLE_TEAMLEAD or roles that include edit_other_timesheet or delete_other_timesheet.
How can I identify potentially affected activity?
Review API activity by ROLE_TEAMLEAD users and roles holding edit_other_timesheet or delete_other_timesheet for access, changes, or deletions involving timesheets owned by users outside the actor's team. The affected behavior permits read, modify, and permanent deletion operations.