What is CVE-2026-80193?

CVE-2026-80193 is a high-severity vulnerability in Kimai, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-08-25.

How severe is CVE-2026-80193?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Kimai

CVE-2026-80193

Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Kimai

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

GitHub Security Advisory (GHSA-2w7f-x78f-89q2) (vendor-advisory)
VulnCheck Advisory: Kimai before 2.62.0 Authorization Bypass via QuickEntry (third-party-advisory)

Frequently asked questions

What is CVE-2026-80193?: CVE-2026-80193 is a high-severity vulnerability in Kimai, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-08-25.
How severe is CVE-2026-80193?: High severity. CVSS v3 base score is 8.8 out of 10.