Security
فارسی
All products

kimai/kimai

Composer · Package
33 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark ManipulationCVE-2026-80197 · GHSA-J5MC-P8QG-39J7 kimai/kimai Composer Low Fix reported
Kimai Password Reset Link Remains Valid After Password ChangeCVE-2026-80196 · GHSA-M492-GV72-XVXJ kimai/kimai Composer Low Fix reported
Kimai API returns timesheet entries a user should not be authorized to viewCVE-2024-29200 · GHSA-CJ3C-5XPM-CX94 kimai/kimai Composer Medium Fix reported
Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templatesCVE-2026-80198 · GHSA-VRQV-52X7-RM4V kimai/kimai Composer Medium Fix reported
Kimai has Missing Voter Check that Allows Cross-Team Timesheet ManipulationCVE-2026-80202 · GHSA-9G2Q-W3W2-VF7Q kimai/kimai Composer Medium Fix reported
Kimai: Username enumeration via timing on X-AUTH-USERCVE-2026-80199 · GHSA-JRC6-FMHW-FPQ2 kimai/kimai Composer Low Fix reported
Kimai leaks API Token Hash via Invoice Twig TemplateCVE-2026-80201 · GHSA-RH42-6RJ2-XWMC kimai/kimai Composer Low Fix reported
Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS HandlerCVE-2026-80200 · GHSA-3JP4-MHH4-GCGR kimai/kimai Composer Low Fix reported
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD AccessCVE-2026-52828 · GHSA-RW46-QG69-VG6H kimai/kimai Composer Medium Fix reported
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTPCVE-2026-52827 · GHSA-V8HX-4VX8-WC96 kimai/kimai Composer High Fix reported
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate ManipulationCVE-2026-52826 · GHSA-2XGG-2X8H-8XW4 kimai/kimai Composer Medium Fix reported
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized VisibilityCVE-2026-52825 · GHSA-XV4R-4885-GWPG kimai/kimai Composer Medium Fix reported
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account TakeoverCVE-2026-52824 · GHSA-JR9P-4H4J-6C58 kimai/kimai Composer Critical Fix reported
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State ChangesCVE-2026-52823 · GHSA-R8VR-M544-QH4H kimai/kimai Composer Medium Fix reported
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access RevocationCVE-2026-52822 · GHSA-C6W6-57JJ-62VH kimai/kimai Composer Medium Fix reported
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized ProjectsCVE-2026-52821 · GHSA-3Q6Q-26VG-V97X kimai/kimai Composer Medium Fix reported
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targetCVE-2026-52819 · GHSA-4M8Q-55QV-9PWP kimai/kimai Composer Medium Fix reported
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure ChangesCVE-2026-49992 · GHSA-PGCC-VFMC-7CW5 kimai/kimai Composer Medium Fix reported
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypassCVE-2026-52820 · GHSA-VRR2-G9GH-C3JC kimai/kimai Composer Medium Fix reported
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLsCVE-2026-49865 · GHSA-PJ8J-P4G4-4VW8 kimai/kimai Composer Medium Fix reported