CVE-2026-52823: Kimai

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.

Affected products

• Kimai Kimai: before 2.58.0 (fixed in 2.58.0)

Published 2026-09-15. Last modified 2026-09-23.