What’s Vulnerable › Products

kimai vulnerabilities

41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.

Check whether your kimai version is affected

Latest kimai vulnerabilities

• CVE-2026-52828 — Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVSS 5.3)
• CVE-2026-52827 — Kimai: Two-factor authentication bypass on the Kimai API (CVSS 7.1)
• CVE-2026-52826 — Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (CVSS 5.3)
• CVE-2026-52825 — Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility (CVSS 5.3)
• CVE-2026-52824 — Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (CVSS 9.1)
• CVE-2026-52823 — Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (CVSS 5.3)
• CVE-2026-52822 — Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (CVSS 5.3)
• CVE-2026-52821 — Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects (CVSS 5.3)
• CVE-2026-52820 — Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass (CVSS 5.3)
• CVE-2026-52819 — Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target (CVSS 6.3)
• CVE-2026-49992 — Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes (CVSS 6.3)
• CVE-2026-49865 — Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (CVSS 5.3)
• CVE-2026-84808 — Kimai before 2.65.0 Authorization Bypass via API Timesheet (CVSS 4.3)
• CVE-2026-84806 — Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints (CVSS 5.4)
• CVE-2026-84805 — Kimai 2.61.0 before 2.63.0 Authentication Bypass via API (CVSS 4.3)
• CVE-2026-84804 — Kimai before 2.65.0 Authorization Bypass via Team Activity API (CVSS 5.4)
• CVE-2026-84807 — Kimai before 2.65.0 Authentication Bypass via Team Creation (CVSS 5.4)
• CVE-2026-80202 — Kimai before 2.56.0 Authorization Bypass via TimesheetVoter (CVSS 8.8)
• CVE-2026-80201 — Kimai before 2.53.0 API Token Leakage via Invoice Template (CVSS 2.0)
• CVE-2026-80200 — Kimai before 2.53.0 Open Redirect via RelayState (CVSS 4.7)
• CVE-2026-80199 — Kimai before 2.54.0 Username Enumeration via Timing Oracle (CVSS 3.7)
• CVE-2026-80198 — Kimai before 2.56.0 Information Disclosure via config() Twig Function (CVSS 7.5)
• CVE-2026-80197 — Kimai before 2.57.0 Improper Authorization via Favorite Endpoints (CVSS 4.3)
• CVE-2026-80196 — Kimai before 2.58.0 Authentication Bypass via Password Reset Link (CVSS 7.5)
• CVE-2026-80195 — Kimai before 2.63.0 Team Membership Removal via API (CVSS 5.4)