CVE-2026-52828 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit… |
CVE-2026-52827 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is a… |
CVE-2026-52826 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{r… |
CVE-2026-52825 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} veri… |
CVE-2026-52824 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_uniq… |
CVE-2026-52823 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/rest… |
CVE-2026-52822 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web dupli… |
CVE-2026-52821 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{c… |
CVE-2026-52820 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identi… |
CVE-2026-52819 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target identifiers from a ca… |
CVE-2026-49992 | | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creat… |
CVE-2026-49865 | | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview an… |
CVE-2026-84808 | Medium | 4.3 | 2026-09-02 | Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team ac… |
CVE-2026-84807 | Medium | 5.4 | 2026-09-02 | Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated us… |
CVE-2026-84806 | Medium | 5.4 | 2026-09-02 | Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and re… |
CVE-2026-84805 | Medium | 4.3 | 2026-09-02 | Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences… |
CVE-2026-84804 | Medium | 5.4 | 2026-09-02 | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated us… |
CVE-2026-80202 | High | 8.8 | 2026-08-26 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
CVE-2026-80201 | Low | 2.0 | 2026-08-26 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
CVE-2026-80200 | Medium | 4.7 | 2026-08-26 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
CVE-2026-80199 | Low | 3.7 | 2026-08-26 | Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-… |
CVE-2026-80198 | High | 7.5 | 2026-08-26 | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary… |
CVE-2026-80197 | Medium | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
CVE-2026-80196 | High | 7.5 | 2026-08-26 | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signat… |
CVE-2026-80195 | Medium | 5.4 | 2026-08-26 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
CVE-2026-80194 | Medium | 4.3 | 2026-08-26 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
CVE-2026-80193 | High | 8.8 | 2026-08-26 | Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with vie… |
CVE-2026-44298 | Medium | 4.1 | 2026-05-08 | Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the pe… |
CVE-2026-42267 | Medium | 5.7 | 2026-05-08 | Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its na… |
CVE-2026-41498 | Low | 3.3 | 2026-05-08 | Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'… |
CVE-2026-40486 | Medium | 4.3 | 2026-04-17 | Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies… |
CVE-2026-40479 | Medium | 5.4 | 2026-04-17 | Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quo… |
CVE-2026-28685 | Medium | 6.5 | 2026-03-06 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission… |
CVE-2019-25317 | Medium | 6.4 | 2026-02-11 | Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can i… |
CVE-2026-23626 | Medium | 6.8 | 2026-01-18 | Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive… |
CVE-2023-53957 | Critical | 9.8 | 2025-12-19 | Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick… |
CVE-2024-4596 | Low | 3.7 | 2024-05-07 | A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Ha… |
CVE-2024-29200 | Medium | 6.8 | 2024-03-28 | Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return… |
CVE-2023-46245 | High | 7.2 | 2023-10-31 | Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escal… |
CVE-2020-19825 | Critical | 9.6 | 2023-02-15 | Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges. |
CVE-2021-43515 | High | 7.8 | 2022-04-08 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious paylo… |
CVE-2021-4033 | Medium | 6.5 | 2021-12-09 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3985 | Critical | 9.0 | 2021-12-01 | kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3963 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3957 | Medium | 4.3 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3976 | Medium | 6.5 | 2021-11-19 | kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2019-15481 | Medium | 6.1 | 2019-08-23 | Kimai v2 before 1.1 has XSS via a timesheet description. |