Description

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-26T05:18:27.230Z",
  "pubdate": "2026-08-26T05:18:27.230Z",
  "executiveSummary": "Kimai versions prior to 2.57.0 are susceptible to an improper authorization vulnerability within the timesheet bookmarking functionality.\nThis flaw resides in the application's handling of favorite timesheet addition and removal endpoints, which fail to adequately validate if the authenticated user has the necessary ownership or permissions to modify a specific timesheet entry in another user's favorite list.\nAn authenticated attacker can abuse this lack of authorization to tamper with the business states of other users by manipulating their cross-user bookmarks.\nThe vulnerability allows for unauthorized modification of data without requiring administrative privileges, effectively breaking the logical isolation between user accounts.\nThe impact includes unauthorized manipulation of another user's favorite timesheet collection, potentially affecting workflow tracking, reporting accuracy, and general business state visibility.\nExploitation requires the attacker to be authenticated, after which they can target known timesheet identifiers to alter the favorite status of entries belonging to other users.",
  "technicalDetails": "The vulnerability exists due to an improper authorization flaw within the Kimai timesheet favorite management endpoints. The application fails to enforce strict access control checks when processing requests to add or remove timesheets from a user's favorite list.\nThe root cause is the absence of a server-side ownership verification mechanism. When the application receives a request to toggle the 'favorite' status of a timesheet—identified by a unique timesheet ID—it does not verify whether the timesheet in question belongs to the context of the user making the request, nor does it verify that the target list being modified is restricted strictly to that user's own data profile.\nAttack flow involves the following steps: 1) The attacker authenticates as a standard, non-privileged user within the Kimai instance. 2) The attacker identifies a target timesheet ID, potentially through enumeration, predictable ID patterns, or direct knowledge of valid timesheet identifiers. 3) The attacker crafts a request to the application's favorite timesheet add or remove endpoints, substituting the target timesheet identifier.\nBecause the server-side logic processes these requests without verifying the relationship between the authenticated session user and the target timesheet data, the application proceeds to execute the requested operation. Consequently, the attacker can programmatically add or remove any timesheet ID to or from the favorites list of any other user, provided the attacker can reach the targeted timesheet resource.\nThis behavior represents a failure in the application's authorization framework (CWE-285). The vulnerability effectively permits cross-user business-state tampering. While this does not directly grant access to the underlying sensitive data of the timesheet itself, it allows for the malicious manipulation of a user's interface-level bookmarking, potentially confusing or disrupting business processes tied to tracked time.\nThe vulnerability affects all Kimai versions prior to 2.57.0. It requires a valid, authenticated session, but explicitly does not require administrative privileges to execute. The exposure is internal to the application, reachable by any authenticated actor who can communicate with the application's API or web interface, regardless of their role within the system."
}