Kimai Kimai

10 CVEs affecting Kimai Kimai. Latest disclosed: 2026-05-08. Critical: 1, High: 1.

Top CVEs affecting Kimai Kimai
CVESeverityScorePublishedSummary
CVE-2023-53957Critical9.82025-12-19Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick…
CVE-2023-46245High7.22023-10-31Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escal…
CVE-2026-23626Medium6.82026-01-18Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive…
CVE-2024-29200Medium6.82024-03-28Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus return…
CVE-2026-28685Medium6.52026-03-06Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission…
CVE-2026-42267Medium5.72026-05-08Kimai is an open-source time tracking application. From version 2.27.0 to before version 2.54.0, any ROLE_USER can create a tag with a formula string as its na…
CVE-2026-40479Medium5.42026-04-17Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml() function in KimaiEscape.js does not escape double quo…
CVE-2026-40486Medium4.32026-04-17Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies…
CVE-2026-44298Medium4.12026-05-08Kimai is an open-source time tracking application. From version 2.32.0 to before version 2.56.0, users with the role System-Admin (ROLE_SYSTE_ADMIN) and the pe…
CVE-2026-41498Low3.32026-05-08Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'…