Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-52828Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Medium 5.3

In plain English

A medium-severity missing authorization in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.58.0	GHSA-rw46-qg69-vg6h

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	< 2.58.0

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/kimai/kimai/security/advisories/GHSA-rw46-qg69-vg6h x_refsource_CONFIRM
https://github.com/kimai/kimai/pull/5952 x_refsource_MISC
https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601 x_refsource_MISC
https://github.com/kimai/kimai/releases/tag/2.58.0 x_refsource_MISC
https://www.kimai.org/en/security/ghsa-rw46-qg69-vg6h x_refsource_MISC