Kimai up to 2.55.9 Team Membership Check voteOnAttribute privileges management

Summaryinfo

A vulnerability was found in Kimai up to 2.55.9. It has been rated as critical. The impacted element is the function TimesheetVoter::voteOnAttribute of the component Team Membership Check. This manipulation causes privileges management. The identification of this vulnerability is CVE-2026-80202. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in Kimai up to 2.55.9. Affected by this vulnerability is the function TimesheetVoter::voteOnAttribute of the component Team Membership Check. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-80202 since 08/26/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 2.56.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Kimai

Version

• 2.55.0
• 2.55.1
• 2.55.2
• 2.55.3
• 2.55.4
• 2.55.5
• 2.55.6
• 2.55.7
• 2.55.8
• 2.55.9

Website

• Product: https://github.com/kimai/kimai/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion