kimai

17 known vulnerabilities in kimai, 1 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-52828 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and…
  • CVE-2026-52827 CVSS 7.1 high Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before…
  • CVE-2026-52826 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}…
  • CVE-2026-52825 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST…
  • CVE-2026-52824 CVSS 9.1 critical Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value…
  • CVE-2026-52823 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET…
  • CVE-2026-52822 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH…
  • CVE-2026-52821 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and…
  • CVE-2026-52820 CVSS 5.3 medium Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a…
  • CVE-2026-52819 CVSS 6.3 medium Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target…
  • CVE-2026-49992 CVSS 6.3 medium Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in…
  • CVE-2026-49865 CVSS 5.3 medium Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their…
  • CVE-2026-84808 CVSS 5.3 medium Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to…
  • CVE-2026-84807 CVSS 5.3 medium Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation…
  • CVE-2026-84806 CVSS 5.3 medium Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team…
  • CVE-2026-84805 CVSS 5.3 medium Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH…
  • CVE-2026-84804 CVSS 5.3 medium Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API…