CVE-2026-28685: Kimai

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.

Affected products

• Kimai Kimai: before 2.51.0 (fixed in 2.51.0)

Published 2026-03-06. Last modified 2026-06-17.