Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-80202Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

High 8.8

In plain English

A high-severity incorrect authorization in kimai from kimai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.56.0	GHSA-9g2q-w3w2-vf7q

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	0 – before 2.56.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-9g2q-w3w2-vf7q) vendor-advisory
VulnCheck Advisory: Kimai before 2.56.0 Authorization Bypass via TimesheetVoter third-party-advisory