CVE Feed

    Dashboard / CVE / CVE-2026-52828

    CVE-2026-52828

    Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.

    Published:Sep 15, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 15, 2026
    EPSS Score:0.00396
    CVSS Score:5.3

    Affected Products

    Vendor
    Kimai
    Product
    Kimai

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-52827 (CVSS 7.1) — Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after pass…
    CVE-2026-52822 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH …
    CVE-2026-52826 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/…
    CVE-2026-52823 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/times…
    CVE-2026-52824 (CVSS 9.1) — Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET …
    CVE-2026-52825 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and …
    CVE-2026-52821 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity…
    CVE-2026-52820 (CVSS 5.3) — Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/t…
    CVE-2026-52819 (CVSS 6.3) — Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint acce…
    CVE-2026-49992 (CVSS 6.3) — Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-52828 — Kimai (Medium 5.3) | CVE-DB