SB2026060457 - Multiple vulnerabilities in kimai2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060457

SB2026060457 - Multiple vulnerabilities in kimai2

Published: June 4, 2026 Updated: June 29, 2026

Security Bulletin ID SB2026060457
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 13% Medium 25% Low 63%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2026-49992)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the default team creation shortcuts. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-49865)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in the invoice PDF preview and generation workflow. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


3) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: N/A)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to gain unauthorized access to a user account.

The vulnerability exists due to weak password recovery mechanism in the login link handler when processing password reset and login links. A remote attacker can use an intercepted or cached login link after the password has been changed to gain unauthorized access to a user account.

The same link remains valid for up to 3 total uses within a 1-hour window, and subsequent uses grant a normal authenticated session after the initial password reset flow has completed.


4) Cross-site request forgery (CVE-ID: CVE-2026-52823)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause unauthorized timesheet state changes.

The vulnerability exists due to cross-site request forgery in src/API/TimesheetController.php when handling state-changing /api/timesheets/{id}/stop and /api/timesheets/{id}/restart requests through browser-authenticated sessions. A remote user can trick the victim into visiting a malicious page to cause unauthorized timesheet state changes.

User interaction is required, and the victim must be logged in for exploitation to succeed.


5) Missing Authorization (CVE-ID: CVE-2026-52828)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify global export templates.

The vulnerability exists due to improper access control in ExportController when handling web requests to create or edit export templates. A remote user can directly access the affected routes to modify global export templates.

The issue affects only the web controller routes; the API routes and UI button visibility enforce the stricter permission requirement.


6) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-52824)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to take over any account.

The vulnerability exists due to initialization of a resource with an insecure default in the Docker image APP_SECRET configuration when handling HMAC-signed cookies and login links. A remote attacker can forge authentication cookies or login links to take over any account.

Exploitation requires that the instance is deployed with the default APP_SECRET unchanged, the attacker knows a username, can guess the corresponding account ID, and the targeted account does not have active two-factor authentication.


7) Missing Authorization (CVE-ID: CVE-2026-52825)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to expand team scope beyond authorized visibility.

The vulnerability exists due to improper authorization in the Team member assignment API when handling crafted backend API requests to add users to an editable team. A remote user can send a specially crafted API request to expand team scope beyond authorized visibility.

Once the unauthorized team relationship is created, downstream authorization and visibility decisions may treat it as legitimate.


8) Missing Authorization (CVE-ID: CVE-2026-52822)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to create new timesheet records under a revoked project and activity combination.

The vulnerability exists due to improper authorization in the timesheet restart and duplicate workflows when handling restart or duplicate requests for historical timesheet entries. A remote user can send a restart or duplicate request for an older owned timesheet to create new timesheet records under a revoked project and activity combination.

The issue affects the API restart and duplicate endpoints as well as the web duplicate flow that reaches the same save logic.


Remediation

Install update from vendor's website.

References