CVE-2026-80202

High

Description

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

SeverityHigh

CVSS8.8

Exploit probability—

ProductKimai/kimai

PublishedAug 26, 2026

First seenAug 26, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

kimai/kimai2.56.0 or later

Vendor advisories

github.com/kimai/kimai/security/advisories/GHSA-9g2q-w3w2-vf7q

Affected products

Product	Affected versions	Fixed in
kimai/kimaiPackagist	v < 2.56.0	2.56.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.