Authorization bypass through user-controlled key in kimai2 - CVE-2026-52820

Detailed vulnerability description

The vulnerability allows a remote user to bypass authorization checks to reassign their own timesheet to an unauthorized project and disclose sensitive project and customer metadata.

The vulnerability exists due to improper access control in the Timesheet API PATCH /api/timesheets/{id} and POST /api/timesheets endpoints when processing a user-supplied project ID through the Symfony EntityType query_builder. A remote user can submit a crafted project ID and then read the modified timesheet with full serialization to bypass authorization checks to reassign their own timesheet to an unauthorized project and disclose sensitive project and customer metadata.

The issue is limited to the attacker's own timesheet records, and reading the modified record with ?full=true exposes serialized project and customer details that would otherwise be filtered by the team ACL.

How to mitigate CVE-2026-52820

Sources

• https://github.com/kimai/kimai/security/advisories/GHSA-vrr2-g9gh-c3jc
• https://www.kimai.org/en/security/ghsa-vrr2-g9gh-c3jc