{"kind": "product", "path": "vulns/packagist/kimai%2Fkimai", "name": "kimai/kimai", "product": "kimai/kimai", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-52827", "noindex": false, "published": "2026-09-15T10:45:03.605Z", "modified": "2026-09-16T16:08:20.250Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00576, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52827", "title": "Kimai: Two-factor authentication bypass on the Kimai API", "description": "Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICATED and App\\API\\Authentication\\ApiRequestMatcher routes an existing session through the main firewall. A Scheb TwoFactorToken satisfies that access rule, and App\\Voter\\ApiVoter grants API access to its User, allowing an attacker with a valid account password to use authenticated REST API operations without entering the second factor even though web routes remain blocked. This issue is fi", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-v8hx-4vx8-wc96", "https://github.com/kimai/kimai/pull/5957", "https://github.com/kimai/kimai/commit/87c85270a98899e6545108cbb9f41103ec6ea312"], "fixes": ["2.59.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52822", "noindex": false, "published": "2026-09-15T10:44:08.637Z", "modified": "2026-09-15T13:52:17.628Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00465, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52822", "title": "Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation", "description": "Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user's current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activit", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-c6w6-57jj-62vh", "https://github.com/kimai/kimai/pull/5952", "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52828", "noindex": false, "published": "2026-09-15T10:43:09.990Z", "modified": "2026-09-15T12:29:14.797Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00465, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52828", "title": "Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access", "description": "Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-rw46-qg69-vg6h", "https://github.com/kimai/kimai/pull/5952", "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52826", "noindex": false, "published": "2026-09-15T10:42:13.451Z", "modified": "2026-09-15T12:41:20.164Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52826", "title": "Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation", "description": "Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admin/activity/{id}/rate/{rate} independently resolve the authorized parent identifier and the attacker-selected child rate identifier without confirming that the ProjectRate, CustomerRate, or ActivityRate belongs to that parent. An authenticated user who can edit one parent object can pair it with a rate record from an unauthorized project, customer, or activity and persist changes to billing configuration in kimai2_projects_rates, kimai2_customers_rates, or kimai2_activi", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-2xgg-2x8h-8xw4", "https://github.com/kimai/kimai/pull/5929", "https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849"], "fixes": ["2.57.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52823", "noindex": false, "published": "2026-09-15T10:41:17.840Z", "modified": "2026-09-15T13:52:24.796Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52823", "title": "Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes", "description": "Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in ver", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-r8vr-m544-qh4h", "https://github.com/kimai/kimai/pull/5952", "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52824", "noindex": false, "published": "2026-09-15T10:40:28.739Z", "modified": "2026-09-16T17:33:01.273Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.01333, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52824", "title": "Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover", "description": "Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated attacker who reaches a deployment that did not override APP_SECRET, knows a username, correctly guesses the account ID associated with that username, and targets an account without active two-factor authentication can forge HMAC-protected authentication artifacts, including KIMAI_REMEMBER cookies and login links, to access the account without it", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-jr9p-4h4j-6c58", "https://github.com/kimai/kimai/pull/5952", "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52825", "noindex": false, "published": "2026-09-15T10:39:15.019Z", "modified": "2026-09-15T12:34:38.943Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00449, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52825", "title": "Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility", "description": "Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the referenced User or view access for the referenced Activity. A teamlead can add users or activities outside the teamlead's manageable scope to an editable team, bypassing the narrower choices enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType(). The resulting relationships can be trusted by RolePermissionManager::checkTeamAccessActivity() and other team-based authorization, visibility, reporti", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-xv4r-4885-gwpg", "https://github.com/kimai/kimai/pull/5952", "https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52821", "noindex": false, "published": "2026-09-15T10:38:16.963Z", "modified": "2026-09-17T14:20:56.384Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52821", "title": "Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects", "description": "Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{customer} require only the generic create_activity or create_project capability and do not verify edit access to the supplied Project or Customer object. A user who knows a valid project.id or customer identifier can use the preset-parent creation logic in src/Controller/ActivityController.php or src/Controller/ProjectController.php to persist a new child business object under an unauthorized parent, polluting project or customer configuration and influencing later time-entry, rate, repo", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-3q6q-26vg-v97x", "https://github.com/kimai/kimai/pull/5929", "https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849"], "fixes": ["2.57.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52820", "noindex": false, "published": "2026-09-15T10:37:17.720Z", "modified": "2026-09-15T12:42:21.215Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00449, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52820", "title": "Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass", "description": "Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks ch", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-vrr2-g9gh-c3jc", "https://github.com/kimai/kimai/pull/5929", "https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849"], "fixes": ["2.57.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-52819", "noindex": false, "published": "2026-09-15T10:36:02.531Z", "modified": "2026-09-15T15:17:07.990Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00496, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-52819", "title": "Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target", "description": "Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target identifiers from a caller with view_other_timesheet but does not apply access_user or verify that a ROLE_TEAMLEAD requester leads a team containing each target user. TimesheetController::cgetAction() adds the resolved users directly to the query while project and customer filtering still permits records on unscoped projects or projects sharing ordinary team membership, allowing a teamlead to retrieve another user's descriptions, timing data, tags, rate, and internalRate even though GET /api/timesheets/{id} ", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-4m8q-55qv-9pwp", "https://github.com/kimai/kimai/pull/5929", "https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849"], "fixes": ["2.57.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49992", "noindex": false, "published": "2026-09-11T21:29:34.927Z", "modified": "2026-09-14T16:14:53.650Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49992", "title": "Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes", "description": "Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harm", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-pgcc-vfmc-7cw5", "https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5", "https://nvd.nist.gov/vuln/detail/CVE-2026-49992"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49865", "noindex": false, "published": "2026-09-11T21:08:47.179Z", "modified": "2026-09-14T19:58:41.023Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49865", "title": "Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs", "description": "Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as `Customer.invoiceText`, the server-side PDF renderer will fetch remote image URLs embedded in Markdown image syntax. This allows the application server to issue outbound requests to attacker-controlled or internal targets during PDF rendering. The behavior can be used for internal network probing, server-side reachability checks, and potentially follow-on exploitation d", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-pj8j-p4g4-4vw8", "https://nvd.nist.gov/vuln/detail/CVE-2026-49865"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80202", "noindex": false, "published": "2026-08-25T23:19:07.165Z", "modified": "2026-10-08T15:25:23.141Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00392, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80202", "title": "Kimai before 2.56.0 Authorization Bypass via TimesheetVoter", "description": "Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-9g2q-w3w2-vf7q", "https://www.vulncheck.com/advisories/kimai-before-2.56.0-authorization-bypass-via-timesheetvoter", "https://nvd.nist.gov/vuln/detail/CVE-2026-80202"], "fixes": ["2.56.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80201", "noindex": false, "published": "2026-08-25T23:19:06.486Z", "modified": "2026-10-08T15:25:22.048Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80201", "title": "Kimai before 2.53.0 API Token Leakage via Invoice Template", "description": "Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc", "https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template", "https://nvd.nist.gov/vuln/detail/CVE-2026-80201"], "fixes": ["2.53.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80200", "noindex": false, "published": "2026-08-25T23:19:05.809Z", "modified": "2026-10-08T15:25:20.694Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.0036, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80200", "title": "Kimai before 2.53.0 Open Redirect via RelayState", "description": "Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-3jp4-mhh4-gcgr", "https://www.vulncheck.com/advisories/kimai-before-2.53.0-open-redirect-via-relaystate", "https://nvd.nist.gov/vuln/detail/CVE-2026-80200"], "fixes": ["2.53.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80199", "noindex": false, "published": "2026-08-25T23:19:05.166Z", "modified": "2026-10-08T15:25:19.728Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00308, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80199", "title": "Kimai before 2.54.0 Username Enumeration via Timing Oracle", "description": "Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-jrc6-fmhw-fpq2", "https://www.vulncheck.com/advisories/kimai-before-2.54.0-username-enumeration-via-timing-oracle", "https://nvd.nist.gov/vuln/detail/CVE-2026-80199"], "fixes": ["2.54.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80198", "noindex": false, "published": "2026-08-25T23:19:04.492Z", "modified": "2026-10-08T15:25:19.148Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80198", "title": "Kimai before 2.56.0 Information Disclosure via config() Twig Function", "description": "Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-vrqv-52x7-rm4v", "https://www.vulncheck.com/advisories/kimai-before-2.56.0-information-disclosure-via-config-twig-function", "https://nvd.nist.gov/vuln/detail/CVE-2026-80198"], "fixes": ["2.56.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80197", "noindex": false, "published": "2026-08-25T23:19:03.788Z", "modified": "2026-10-08T15:25:18.540Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00264, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80197", "title": "Kimai before 2.57.0 Improper Authorization via Favorite Endpoints", "description": "Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7", "https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints", "https://nvd.nist.gov/vuln/detail/CVE-2026-80197"], "fixes": ["2.57.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-80196", "noindex": false, "published": "2026-08-25T23:19:03.107Z", "modified": "2026-10-08T15:25:17.971Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00476, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-80196", "title": "Kimai before 2.58.0 Authentication Bypass via Password Reset Link", "description": "Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-m492-gv72-xvxj", "https://www.vulncheck.com/advisories/kimai-before-2.58.0-authentication-bypass-via-password-reset-link", "https://nvd.nist.gov/vuln/detail/CVE-2026-80196"], "fixes": ["2.58.0"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44298", "noindex": false, "published": "2026-05-08T03:32:06.672Z", "modified": "2026-05-08T14:06:31.033Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44298", "title": "Kimai: Arbitrary file read in invoice PDF renderer (admin)", "description": "Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the permission upload_invoice_template can upload PDF invoice templates, which can call pdfContext.setOption('associated_files', ...) inside the sandboxed Twig render. This is forwarded to mPDF's SetAssociatedFiles(), whose writer calls file_get_contents($entry['path']) during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice. This issue has been patched in version 2.56.0.", "references": ["https://github.com/kimai/kimai/security/advisories/GHSA-h5fh-7hwr-97mw", "https://github.com/kimai/kimai/releases/tag/2.56.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-44298"], "fixes": ["2.56"], "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}]}], "total": 33, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "kimai/kimai", "path": "vulns/packagist/kimai%2Fkimai", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["2.58.0", "2.57.0", "2.56.0", "2.56", "2.55.0", "2.54.0", "2.53.0", "2.52.0", "2.51.0", "2.50.0", "2.49.0", "2.48.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-08T15:25:23.141Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}