Authorization bypass through user-controlled key in kimai2 - CVE-2026-52826

Detailed vulnerability description

The vulnerability allows a remote user to modify billing-related rate configuration outside their authorized project, customer, or activity scope.

The vulnerability exists due to improper authorization in the project, customer, and activity rate edit endpoints when handling user-controlled parent and rate identifiers in web requests. A remote user can send a crafted request with an authorized parent ID and an unauthorized rate ID to modify billing-related rate configuration outside their authorized project, customer, or activity scope.

The issue affects the ProjectRate, CustomerRate, and ActivityRate editing flows because the application resolves the parent object and rate object independently without verifying that the rate belongs to the referenced parent.

How to mitigate CVE-2026-52826

Sources

• https://github.com/kimai/kimai/security/advisories/GHSA-2xgg-2x8h-8xw4
• https://www.kimai.org/en/security/ghsa-2xgg-2x8h-8xw4