# cve.now: Kimai

The newest entries naming Kimai as an affected vendor (up to 200), of 37 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-52827](https://cve.now/CVE-2026-52827.md): Kimai: Two-factor authentication bypass on the Kimai API (CVSS 7.1)
- [CVE-2026-52822](https://cve.now/CVE-2026-52822.md): Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (CVSS 5.3)
- [CVE-2026-52828](https://cve.now/CVE-2026-52828.md): Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVSS 5.3)
- [CVE-2026-52826](https://cve.now/CVE-2026-52826.md): Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (CVSS 5.3)
- [CVE-2026-52823](https://cve.now/CVE-2026-52823.md): Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (CVSS 5.3)
- [CVE-2026-52824](https://cve.now/CVE-2026-52824.md): Kimai: Default APP\_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (CVSS 9.1)
- [CVE-2026-52825](https://cve.now/CVE-2026-52825.md): Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility (CVSS 5.3)
- [CVE-2026-52821](https://cve.now/CVE-2026-52821.md): Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects (CVSS 5.3)
- [CVE-2026-52820](https://cve.now/CVE-2026-52820.md): Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query\_builder OR-bypass (CVSS 5.3)
- [CVE-2026-52819](https://cve.now/CVE-2026-52819.md): Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target (CVSS 6.3)
- [CVE-2026-49992](https://cve.now/CVE-2026-49992.md): Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes (CVSS 6.3)
- [CVE-2026-49865](https://cve.now/CVE-2026-49865.md): Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (CVSS 5.3)
- [CVE-2026-84808](https://cve.now/CVE-2026-84808.md): Kimai before 2.65.0 Authorization Bypass via API Timesheet (CVSS 5.3)
- [CVE-2026-84807](https://cve.now/CVE-2026-84807.md): Kimai before 2.65.0 Authentication Bypass via Team Creation (CVSS 5.3)
- [CVE-2026-84806](https://cve.now/CVE-2026-84806.md): Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints (CVSS 5.3)
- [CVE-2026-84805](https://cve.now/CVE-2026-84805.md): Kimai 2.61.0 before 2.63.0 Authentication Bypass via API (CVSS 5.3)
- [CVE-2026-84804](https://cve.now/CVE-2026-84804.md): Kimai before 2.65.0 Authorization Bypass via Team Activity API (CVSS 5.3)
- [CVE-2026-80202](https://cve.now/CVE-2026-80202.md): Kimai before 2.56.0 Authorization Bypass via TimesheetVoter (CVSS 9.3)
- [CVE-2026-80201](https://cve.now/CVE-2026-80201.md): Kimai before 2.53.0 API Token Leakage via Invoice Template (CVSS 2.0)
- [CVE-2026-80200](https://cve.now/CVE-2026-80200.md): Kimai before 2.53.0 Open Redirect via RelayState (CVSS 5.3)
- [CVE-2026-80199](https://cve.now/CVE-2026-80199.md): Kimai before 2.54.0 Username Enumeration via Timing Oracle (CVSS 6.3)
- [CVE-2026-80198](https://cve.now/CVE-2026-80198.md): Kimai before 2.56.0 Information Disclosure via config() Twig Function (CVSS 8.7)
- [CVE-2026-80197](https://cve.now/CVE-2026-80197.md): Kimai before 2.57.0 Improper Authorization via Favorite Endpoints (CVSS 8.7)
- [CVE-2026-80196](https://cve.now/CVE-2026-80196.md): Kimai before 2.58.0 Authentication Bypass via Password Reset Link (CVSS 8.7)
- [CVE-2026-80195](https://cve.now/CVE-2026-80195.md): Kimai before 2.63.0 Team Membership Removal via API (CVSS 8.7)
- [CVE-2026-80194](https://cve.now/CVE-2026-80194.md): Kimai before 2.64.0 Missing Authorization via ProjectViewController export (CVSS 8.7)
- [CVE-2026-80193](https://cve.now/CVE-2026-80193.md): Kimai before 2.62.0 Authorization Bypass via QuickEntry (CVSS 8.7)
- [CVE-2026-44298](https://cve.now/CVE-2026-44298.md): Kimai: Arbitrary file read in invoice PDF renderer (admin) (CVSS 4.1)
- [CVE-2026-41498](https://cve.now/CVE-2026-41498.md): Kimai: Team API Missing Object-Level Authorization (CVSS 3.3)
- [CVE-2026-42267](https://cve.now/CVE-2026-42267.md): Kimai: Formula Injection via tag names in XLSX export (CVSS 5.4)
- [CVE-2026-40486](https://cve.now/CVE-2026-40486.md): Kimai's User Preferences API allows standard users to modify restricted attributes: hourly\_rate, internal\_rate (CVSS 4.3)
- [CVE-2026-40479](https://cve.now/CVE-2026-40479.md): Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget (CVSS 5.4)
- [CVE-2026-28685](https://cve.now/CVE-2026-28685.md): Kimai: API invoice endpoint missing customer-level access control (IDOR) (CVSS 6.5)
- [CVE-2026-23626](https://cve.now/CVE-2026-23626.md): Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI) (CVSS 6.8)
- [CVE-2023-53957](https://cve.now/CVE-2023-53957.md): Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking (CVSS 8.5)
- [CVE-2024-29200](https://cve.now/CVE-2024-29200.md): API returns timesheet entries a user should not be authorized to view (CVSS 6.8)
- [CVE-2023-46245](https://cve.now/CVE-2023-46245.md): Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kimai
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.