Kimai vulnerabilities
37 CVEs and advisories name Kimai as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-52827Kimai: Two-factor authentication bypass on the Kimai API
- CVE-2026-52822Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation
- CVE-2026-52828Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
- CVE-2026-52826Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
- CVE-2026-52823Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
- CVE-2026-52824Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
- CVE-2026-52825Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
- CVE-2026-52821Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects
- CVE-2026-52820Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
- CVE-2026-52819Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
- CVE-2026-49992Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
- CVE-2026-49865Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs
- CVE-2026-84808Kimai before 2.65.0 Authorization Bypass via API Timesheet
- CVE-2026-84807Kimai before 2.65.0 Authentication Bypass via Team Creation
- CVE-2026-84806Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
- CVE-2026-84805Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
- CVE-2026-84804Kimai before 2.65.0 Authorization Bypass via Team Activity API
- CVE-2026-80202Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
- CVE-2026-80201Kimai before 2.53.0 API Token Leakage via Invoice Template
- CVE-2026-80200Kimai before 2.53.0 Open Redirect via RelayState
- CVE-2026-80199Kimai before 2.54.0 Username Enumeration via Timing Oracle
- CVE-2026-80198Kimai before 2.56.0 Information Disclosure via config() Twig Function
- CVE-2026-80197Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
- CVE-2026-80196Kimai before 2.58.0 Authentication Bypass via Password Reset Link
- CVE-2026-80195Kimai before 2.63.0 Team Membership Removal via API
- CVE-2026-80194Kimai before 2.64.0 Missing Authorization via ProjectViewController export
- CVE-2026-80193Kimai before 2.62.0 Authorization Bypass via QuickEntry
- CVE-2026-44298Kimai: Arbitrary file read in invoice PDF renderer (admin)
- CVE-2026-41498Kimai: Team API Missing Object-Level Authorization
- CVE-2026-42267Kimai: Formula Injection via tag names in XLSX export