CVE-2026-80202: Kimai

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

Affected products

• Kimai Kimai: before 2.56.0 (fixed in 2.56.0)

Published 2026-08-26. Last modified 2026-10-08.