CVE-2026-52819

Executive Summary

CVE-2026-52819 is an authorization bypass (CWE-863, incorrect authorization) in Kimai, an open-source time tracking application, affecting versions prior to 2.57.0. A user holding the view_other_timesheet permission with a ROLE_TEAMLEAD role can query the GET /api/timesheets list endpoint using user and users[] parameters to retrieve timesheet records belonging to users outside their own team scope. The impact is unauthorized disclosure of sensitive workforce data: descriptions, timing data, tags, rate, and internalRate — the last being internal, margin-revealing cost data — despite the single-record endpoint GET /api/timesheets/{id} enforcing access control via TimesheetVoter.

Technical Analysis

Kimai exposes a REST API for time tracking. The vulnerable component is the timesheet list endpoint, GET /api/timesheets, implemented by TimesheetController::cgetAction(). This endpoint accepts caller-supplied target identifiers via the user and users[] query parameters. According to the NVD description, the handler does not apply the access_user constraint and does not verify that a ROLE_TEAMLEAD requester actually leads a team containing each requested target user.

The core defect is a scope-authorization mismatch between a collection endpoint and an item endpoint. Authorization for the single-record endpoint GET /api/timesheets/{id} is correctly enforced by a dedicated authorization component, TimesheetVoter. The voter denies access when the requester lacks a legitimate relationship to the record's owner. The list endpoint, however, does not route its returned rows through the equivalent owner-scoping check.

The enabling conditions described are:

1. The caller possesses the view_other_timesheet permission — a permission intended to allow viewing other users' timesheets but bounded by team/role scope.
2. The caller holds ROLE_TEAMLEAD, which is meant to confine visibility to users in teams the requester leads.
3. The endpoint adds the resolved users (from user / users[]) directly into the query rather than validating them against the requester's team leadership scope.

Additionally, the description notes that project and customer filtering "still permits records on unscoped projects or projects sharing ordinary team membership." In other words, even where project- or customer-level scoping exists, it is insufficient to prevent cross-user exposure because ordinary (non-leadership) team membership satisfies those filters. The authorization model thus fails on two axes: (a) no access_user check on the target user list, and (b) project/customer filters that are too permissive to serve as a compensating control.

This is a classic broken object-level authorization / broken function-level authorization pattern (CWE-863): the object-level guard exists but is applied inconsistently across sibling endpoints. The attack requires only network reachability to the API and a low-privileged authenticated account with the described role/permission combination — no user interaction, no special tooling, no elevated privileges.

Rate and internalRate fields deserve emphasis: the description explicitly states these are returned. rate is externally billable cost data; internalRate is typically internal cost/recharge data not intended for general visibility. Their disclosure is the principal confidentiality harm, alongside narrative descriptions, timing data, and tags.

Insufficient public detail exists to describe the exact SQL/ORM construction beyond what the description states — namely, that resolved users are added directly to the query. No CVE-specific PoC, exploit code, or Nuclei template is available at the time of writing (POC_STATUS: None; EPSS 0.00372, ~30.9th percentile).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker obtains a valid Kimai account that carries the view_other_timesheet permission and the ROLE_TEAMLEAD role, and identifies the API base path (/api/timesheets). The attacker learns candidate target user identifiers by enumerating users the list endpoint itself exposes or through ordinary application visibility into team members, customer assignments, or user directories.

2. Triggering the flaw class. The attacker issues an authenticated request to GET /api/timesheets and supplies user and/or users[] parameters naming target users who are not members of any team the attacker leads. Because cgetAction() adds the resolved users directly to the query without applying access_user and without verifying the requester's team-leadership relationship to each target, the filter accepts the out-of-scope targets. The description further indicates that project and customer filtering is satisfied by ordinary (non-leadership) team membership or by unscoped projects, so the permissive filters do not block the request.

3. Payload / execution method (class level). The request is a standard authenticated HTTP GET with query-string parameters (user=, users[]=). No payload injection, code execution, or malformed input is required — this is a pure authorization-logic bypass exercised through legitimate API syntax. The "payload" is simply the identifier of a user outside the requester's authorized scope.

4. Post-exploitation impact. The response returns the target users' timesheet descriptions, timing data, tags, rate, and internalRate. This is a read-only confidentiality breach. Notably, the same records are denied via GET /api/timesheets/{id}, which enforces access through TimesheetVoter, demonstrating that the attacker is circumventing an existing control. An attacker can iterate over many user identifiers to bulk-harvest workforce and billing data.

No evidence of in-the-wild exploitation, threat-actor campaigns, or CISA KEV listing exists for this CVE.

Impact Assessment

This is an information-disclosure / authorization-bypass vulnerability. Applicable CVSS subscores (using a representative CVSS:3.1 vector, since none is published): AV:N (network-reachable API), AC:L (no special conditions), PR:L (requires an authenticated low-privileged role), UI:N (no user interaction), S:U (scope unchanged), C:H (disclosure of descriptions, timing, tags, rate, and internalRate), I:N, A:N.

Business impact:

• Data confidentiality: Exposure of workforce activity data and, critically, internal cost figures (internalRate) that may reveal margins, contractor costs, or client pricing structures.
• Blast radius: Any Kimai deployment prior to 2.57.0 with users assigned view_other_timesheet and ROLE_TEAMLEAD roles. Exposure affects records of arbitrary users referenced via the user/users[] parameters, not merely the requester's team.
• Regulatory/contractual: Time and billing records may constitute personal or commercially sensitive data; unauthorized cross-user access may breach internal data-governance or client confidentiality obligations.
• Detection difficulty: Requests are well-formed and authenticated; the abuse pattern is a legitimate API call with unusual target identifiers, complicating naive detection.

Exploitability: Low complexity, network-accessible, requires authentication only. EPSS is low (0.00372), and there is no known exploitation, KEV listing, or public PoC — reducing immediate urgency but not the underlying authorization defect.

Detection Guidance

Sigma Rule

title: Kimai Timesheet List Authorization Bypass (CVE-2026-52819)
id: 8f4c1e2a-9b7d-4e21-a6c3-2f1d0b6e5a19
status: experimental
description: Detects access to GET /api/timesheets with user/users[] parameters indicating potential cross-user timesheet enumeration by a teamlead lacking scope authorization (CVE-2026-52819).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52819
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: kimai
detection:
  selection_endpoint:
    cs-method: 'GET'
    cs-uri-stem|endswith: '/api/timesheets'
  selection_params:
    cs-uri-query|contains:
      - 'users%5B%5D='
      - 'users[]='
      - 'user='
  condition: selection_endpoint and selection_params
falsepositives:
  - Legitimate teamleads querying their own team members
  - Administrative reporting tools with broad scope
level: medium
tags:
  - attack.t1078
  - cve.2026.52819

YARA Rule

rule CVE_2026_52819_Kimai_Timesheet_Authz_Bypass
{
    meta:
        description = "Detects references to the Kimai timesheet list endpoint and user/users[] scoping parameters associated with CVE-2026-52819 authorization bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52819"
        date = "2026-01-01"
        tlp = "WHITE"

    strings:
        $ep1 = "/api/timesheets" ascii nocase
        $p1  = "users[]=" ascii nocase
        $p2  = "view_other_timesheet" ascii nocase
        $p3  = "TimesheetVoter" ascii nocase
        $p4  = "TimesheetController" ascii nocase
        $r1  = "internalRate" ascii nocase

    condition:
        $ep1 and (any of ($p*)) and $r1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52819 Kimai Timesheet List Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/timesheets"; http.uri; content:"users"; nocase; http.uri; content:"user"; nocase; reference:cve,2026-52819; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-52819; classtype:attempted-recon; sid:202652819; rev:1;)

Elastic Detection

sequence by user.name with maxspan=1m
  [ network where http.request.method == "GET" and
      http.request.uri like "/api/timesheets*" and
      (http.request.uri like "*user=*" or http.request.uri like "*users[]=*") ]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_path="/api/timesheets" OR uri="*\/api\/timesheets*")
  (uri_query="*user=*" OR uri_query="*users[]=*" OR uri_query="*users%5B%5D=*")
| eval target_users=mvcount(mvfilter(match(uri_query,"(^|&)users(\[\]|%5B%5D)?=")))
| stats count dc(clientip) AS unique_ips values(uri_query) AS queries BY user, uri_path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="kimai,web,accesslog,">
  <rule id="202652819" level="10">
    <if_sid>31100</if_sid>
    <match>/api/timesheets</match>
    <regex>user=|users\[\]=|users%5B%5D=</regex>
    <description>CVE-2026-52819: Possible Kimai timesheet list authorization bypass - user/users[] scoping parameter on /api/timesheets</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_52819,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The fix is described as available in version 2.57.0; this claim originates from a single source (OSV), and affected-version ranges provided to this analysis are empty/unfixed in the OSV package data. Validate the fix independently before relying on it.

1. Immediate mitigations (until patch is verified):

   • Audit user role assignments and remove ROLE_TEAMLEAD from any account that does not genuinely need team-leadership visibility, and revoke view_other_timesheet where not required.
   • Restrict network access to /api/timesheets (and the API generally) to trusted networks or authenticated reverse-proxy paths.
   • Apply compensating controls at a WAF/reverse proxy to reject or alert on user/users[] parameters on the list endpoint where operationally feasible. Caution: these are temporary workarounds; they do not fix the underlying authorization defect.
   • Monitor API logs for anomalous cross-user timesheet enumeration (see Detection Guidance).

2. Patch / upgrade steps:

   • Upgrade Kimai to 2.57.0 or later from the official source.
   • Because patch confidence is 2/4, verify the release notes/changelog explicitly reference the authorization fix for the timesheet list endpoint, and confirm behavior in a staging environment by testing whether GET /api/timesheets with out-of-scope user/users[] identifiers returns data it should not.
   • Re-test the single-record endpoint (GET /api/timesheets/{id}) enforcement remains intact post-upgrade.

3. Long-term hardening:

   • Apply the access_user scope and team-leadership checks consistently across all collection endpoints, not only single-object endpoints; treat authorization as a shared concern to avoid collection-vs-item drift.
   • Ensure project/customer filters cannot be satisfied by ordinary (non-leadership) team membership as a compensating control.
   • Adopt automated authorization regression tests that attempt cross-scope access on every list endpoint as part of CI.
   • Enforce least privilege on view_other_timesheet and ROLE_TEAMLEAD assignments; review role definitions periodically.

References

• NVD — CVE-2026-52819: https://nvd.nist.gov/vuln/detail/CVE-2026-52819
• OSV — package advisory entry for Kimai / 2.57.0 fix claim (single source): https://osv.dev/list?q=CVE-2026-52819
• Kimai project (official source and release notes for 2.57.0): https://www.kimai.org/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

Threat actor / exploit-in-the-wild evidence: None. CISA KEV: NO. No public PoC, exploit code, or Nuclei template identified. No known campaigns associated with this CVE at time of writing.