Kimai vulnerabilities
37 CVEs and advisories name Kimai as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-40486Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
- CVE-2026-40479Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget
- CVE-2026-28685Kimai: API invoice endpoint missing customer-level access control (IDOR)
- CVE-2026-23626Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
- CVE-2023-53957Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2024-29200API returns timesheet entries a user should not be authorized to view
- CVE-2023-46245Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File