Log in Start free

Kimai

Products

ProductCVEsExploitedLatest
Kimai37–Sep 15, 2026

Exploited and recent CVEs

  • CVE-2026-52827 High 7.1 Kimai: Two-factor authentication bypass on the Kimai API 0.6%
  • CVE-2026-52822 Medium 5.3 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation 0.5%
  • CVE-2026-52828 Medium 5.3 Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access 0.5%
  • CVE-2026-52826 Medium 5.3 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation 0.4%
  • CVE-2026-52823 Medium 5.3 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes 0.3%
  • CVE-2026-52824 Critical 9.1 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover 1.3%
  • CVE-2026-52825 Medium 5.3 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility 0.4%
  • CVE-2026-52821 Medium 5.3 Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects 0.4%
  • CVE-2026-52820 Medium 5.3 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass 0.4%
  • CVE-2026-52819 Medium 6.3 Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target 0.5%
  • CVE-2026-49992 Medium 6.3 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes 0.2%
  • CVE-2026-49865 Medium 5.3 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs 0.4%
  • CVE-2026-84808 Medium 4.3 Kimai before 2.65.0 Authorization Bypass via API Timesheet 0.3%
  • CVE-2026-84807 Medium 5.4 Kimai before 2.65.0 Authentication Bypass via Team Creation 0.3%
  • CVE-2026-84806 Medium 5.4 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints 0.2%
  • CVE-2026-84805 Medium 4.3 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API 0.3%
  • CVE-2026-84804 Medium 5.4 Kimai before 2.65.0 Authorization Bypass via Team Activity API 0.3%
  • CVE-2026-80202 High 8.8 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter 0.4%
  • CVE-2026-80201 Low 2.0 Kimai before 2.53.0 API Token Leakage via Invoice Template 0.2%
  • CVE-2026-80200 Medium 4.7 Kimai before 2.53.0 Open Redirect via RelayState 0.4%
  • CVE-2026-80199 Low 3.7 Kimai before 2.54.0 Username Enumeration via Timing Oracle 0.3%
  • CVE-2026-80198 High 7.5 Kimai before 2.56.0 Information Disclosure via config() Twig Function 0.4%
  • CVE-2026-80197 Medium 4.3 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints 0.3%
  • CVE-2026-80196 High 7.5 Kimai before 2.58.0 Authentication Bypass via Password Reset Link 0.5%
  • CVE-2026-80195 Medium 5.4 Kimai before 2.63.0 Team Membership Removal via API 0.4%
  • CVE-2026-80194 Medium 4.3 Kimai before 2.64.0 Missing Authorization via ProjectViewController export 0.3%
  • CVE-2026-80193 High 8.8 Kimai before 2.62.0 Authorization Bypass via QuickEntry 0.5%
  • CVE-2026-44298 Medium 4.1 Kimai: Arbitrary file read in invoice PDF renderer (admin) 0.3%
  • CVE-2026-41498 Low 3.3 Kimai: Team API Missing Object-Level Authorization 0.2%
  • CVE-2026-42267 Medium 5.4 Kimai: Formula Injection via tag names in XLSX export 0.2%