p PatchFirst

CVE-2026-52823

CVE-2026-52823 · Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • kimai

    Versions
    • < 2.58.0: Affected

    No fix published

  • kimai/kimai Packagist

    Versions
    • 0.1
    • 0.2
    • 0.3
    • 0.4
    • 0.5
    • 0.6
    • 0.6.1
    • 0.7
    • 0.8
    • 0.8.1
    • 0.9
    • 1.0
    • 1.0.1
    • 1.1
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.11
    • 1.11.1
    • 1.12
    • 1.13
    • 1.14
    • 1.14.1
    • 1.14.2
    • 1.14.3
    • 1.15
    • 1.15.1
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.15.5
    • 1.15.6
    • 1.16
    • 1.16.1
    • 1.16.10
    • 1.16.2
    • 1.16.3
    • 1.16.4
    • 1.16.5
    • 1.16.6
    • 1.16.7
    • 1.16.8
    • 1.16.9
    • 1.17
    • 1.17.1
    • 1.18
    • 1.18.1
    • 1.18.2
    • 1.19
    • 1.19.1
    • 1.19.2
    • 1.19.3
    • 1.19.4
    • 1.19.5
    • 1.19.6
    • 1.19.7
    • 1.2
    • 1.20
    • 1.20.1
    • 1.20.2
    • 1.20.3
    • 1.20.4
    • 1.21.0
    • 1.22.0
    • 1.22.1
    • 1.23.0
    • 1.23.1
    • 1.24.0
    • 1.25.0
    • 1.26.0
    • 1.27.0
    • 1.28.0
    • 1.28.1
    • 1.29.0
    • 1.29.1
    • 1.3
    • 1.30.0
    • 1.30.1
    • 1.30.10
    • 1.30.11
    • 1.30.2
    • 1.30.3
    • 1.30.4
    • 1.30.5
    • 1.30.6
    • 1.30.7
    • 1.30.8
    • 1.30.9
    • 1.4
    • 1.4.1
    • 1.4.2
    • 1.5
    • 1.6
    • 1.6.1
    • 1.6.2
    • 1.7
    • 1.8
    • 1.9
    • 2.0.0
    • 2.0.0-alpha
    • 2.0.0-beta
    • 2.0.0-beta-2
    • 2.0.0-beta-3
    • 2.0.0-rc-1
    • 2.0.1
    • 2.0.10
    • 2.0.11
    • 2.0.12
    • 2.0.13
    • 2.0.14
    • 2.0.15
    • 2.0.16
    • 2.0.17
    • 2.0.18
    • 2.0.19
    • 2.0.2
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.28
    • 2.0.29
    • 2.0.3
    • 2.0.30
    • 2.0.31
    • 2.0.32
    • 2.0.33
    • 2.0.34
    • 2.0.35
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    • 2.1.0
    • 2.10.0
    • 2.11.0
    • 2.12.0
    • 2.13.0
    • 2.14.0
    • 2.15.0
    • 2.16.0
    • 2.16.1
    • 2.17.0
    • 2.18.0
    • 2.19.0
    • 2.19.1
    • 2.2.0
    • 2.2.1
    • 2.20.0
    • 2.20.1
    • 2.21.0
    • 2.22.0
    • 2.23.0
    • 2.24.0
    • 2.25.0
    • 2.26.0
    • 2.27.0
    • 2.28.0
    • 2.29.0
    • 2.3.0
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.33.0
    • 2.34.0
    • 2.35.0
    • 2.35.1
    • 2.36.0
    • 2.36.1
    • 2.37.0
    • 2.38.0
    • 2.39.0
    • 2.4.0
    • 2.4.1
    • 2.40.0
    • 2.41.0
    • 2.42.0
    • 2.43.0
    • 2.44.0
    • 2.45.0
    • 2.46.0
    • 2.47.0
    • 2.48.0
    • 2.49.0
    • 2.5.0
    • 2.50.0
    • 2.51.0
    • 2.52.0
    • 2.53.0
    • 2.54.0
    • 2.55.0
    • 2.56.0
    • 2.57.0
    • 2.6.0
    • 2.7.0
    • 2.8.0
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.58.0

    Update to 2.58.0

Original sources

Check your server →