CVE-2026-52822

Executive Summary

CVE-2026-52822 is an improper authorization vulnerability (CWE-285) in Kimai, an open-source time tracking application, affecting versions prior to 2.58.0. The flaw allows a user whose access to a project or activity has been administratively revoked to continue creating new timesheet records under that unauthorized project or activity by restarting or duplicating an old, previously owned timesheet entry via PATCH API endpoints or the web duplicate workflow. The impact is integrity-focused: corrupted budget tracking, statistics, reports, and invoices stemming from unauthorized time record creation.

Technical Analysis

The vulnerability resides in the authorization logic of the TimesheetVoter component. As documented in the NVD description, TimesheetVoter evaluates the "own-timesheet" permission before checking the user's current team access to the referenced project and activity. Critically, its canStart() logic validates object visibility — confirming that the user can see the existing historical timesheet — but does not verify whether the user still holds current team access to the project and activity referenced by that entry.

This ordering and completeness gap means the existence of an old, formerly-authorized timesheet functions as a persistent capability token. When a user invokes PATCH /api/timesheets/{id}/restart or PATCH /api/timesheets/{id}/duplicate, the application derives a new record from the referenced historical entry. Because the authorization check passes on the basis of the user's ownership/visibility of the old record rather than on their present entitlement to the underlying project or activity, the newly generated record inherits attributes (project and activity references) the user is no longer authorized to use.

The attack surface is exposed through both the REST API (two PATCH endpoints) and the web-based duplicate workflow. All three paths converge on the same authorization weakness. Exploitation requires only an authenticated account that previously had legitimate access to a project or activity — no elevated privileges, race conditions, or user interaction beyond the attacker's own actions are needed. The vulnerability class is a broken/improper authorization (authorization bypass via stale relationship), where a historical authorization grant is not re-validated at the point of a state-creating operation.

The root cause is a failure to enforce current-state authorization on a derived resource: authorization decisions are based on the historical record's ownership rather than on the user's current team membership and project/activity entitlements. Fixing this required the canStart() logic (or an equivalent check) to validate present-day team access to the referenced project and activity before permitting restart/duplication.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The following attack chain is inferred strictly from the vulnerability class and the details enumerated in the NVD description; no additional endpoints, parameters, or function names beyond those explicitly documented are asserted.

1. Reconnaissance / target identification: The attacker identifies a Kimai instance (versions prior to 2.58.0) and authenticates with a valid low-privilege account. The attacker must historically have held access to a project or activity — access that has since been administratively revoked. The attacker enumerates historical timesheets they previously owned (via the web UI or by listing records they can still view).

2. Triggering the flaw: The attacker locates the {id} of a historical timesheet that references the now-revoked project or activity. Because TimesheetVoter evaluates the own-timesheet permission and validates object visibility before current team access, the stale entry remains "actionable."

3. Execution method: The attacker issues PATCH /api/timesheets/{id}/restart or PATCH /api/timesheets/{id}/duplicate against the historical record, or alternatively uses the web duplicate workflow. The application derives a new timesheet record from the old one. At the vulnerability-class level, the authorization control is bypassed because it does not re-check the user's present team access to the referenced project and activity; the derived record is therefore created under a project/activity the user is no longer entitled to log time against.

4. Post-exploitation impact: Each resting/duplicated record inserts unauthorized time data into the revoked project and activity. This corrupts budgets, statistics, reports, and invoices, as stated in the description. The effect is persistent: the old entry acts as a reusable capability to create further unauthorized records, enabling repeated or automated abuse until the flaw is remediated.

No evidence of in-the-wild exploitation, malware association, or named threat-actor campaigns was found in the provided data.

Impact Assessment

Referencing the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N): the attack is network-reachable (AV:N), requires low complexity (AC:L), needs only low privileges (PR:L), and no user interaction (UI:N). Scope is unchanged (S:U). Confidentiality impact is none (C:N). Integrity impact is high (I:H) — attackers can create and persist unauthorized time records. Availability impact is none (A:N).

Business impact centers on financial and operational data integrity: corrupted budgets (overstated labor consumption for revoked projects/activities), skewed statistics, inaccurate reports, and wrong invoicing. Because Kimai timesheets commonly feed billing and invoicing workflows, unauthorized entries translate directly into billing disputes, revenue leakage, or over-billing. Blast radius spans every project or activity a once-authorized user has since been removed from, on every unpatched instance (< 2.58.0). The EPSS score is 0.00356 (29.1% percentile), indicating low near-term exploitation probability; CISA KEV does not list this CVE, and no exploit code, PoC, or Nuclei template exists. Patch confidence is 2/4 (CLAIMED): a single source (OSV) claims the fix, not independently confirmed.

Detection Guidance

Sigma Rule

title: Kimai Timesheet Restart/Duplicate After Access Revocation (CVE-2026-52822)
id: 9f2c1a77-52822-4b3e-9c1a-kimai20260
status: experimental
description: Detects repeated use of timesheet restart/duplicate endpoints, consistent with abuse of stale project/activity authorization in Kimai < 2.58.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52822
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'PATCH'
  selection_path:
    cs-uri-stem|contains:
      - '/api/timesheets/'
    cs-uri-stem|endswith:
      - '/restart'
      - '/duplicate'
  condition: selection_method and selection_path
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate users duplicating/restarting their own active timesheets
level: medium

YARA Rule

rule CVE_2026_52822_Kimai_Timesheet_Authz_Abuse
{
    meta:
        description = "Detects references to Kimai timesheet restart/duplicate endpoints in HTTP traffic or logs indicating CVE-2026-52822 abuse"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52822"
        date = "2026-01-01"
    strings:
        $ep1 = "/api/timesheets/" ascii wide
        $ep2 = "/restart" ascii wide
        $ep3 = "/duplicate" ascii wide
        $mth = "PATCH" ascii wide
    condition:
        $ep1 and $mth and ($ep2 or $ep3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52822 Kimai Timesheet Restart/Duplicate Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/timesheets/"; http.uri; content:"/restart"; nocase; sid:5282201; rev:1;)
alert http any any -> any any (msg:"CVE-2026-52822 Kimai Timesheet Duplicate Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"/api/timesheets/"; http.uri; content:"/duplicate"; nocase; sid:5282202; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "PATCH" and
        wildcard(http.request.path, "/api/timesheets/*/restart")]
  [http where http.request.method == "PATCH" and
        wildcard(http.request.path, "/api/timesheets/*/duplicate")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_cve=if((method="PATCH") AND (match(uri_path,"^/api/timesheets/.+/(restart|duplicate)$")),1,0)
| where is_cve=1
| stats count values(uri_path) as endpoints values(status) as statuses by src_ip user
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,kimai,cve-2026-52822,">
  <rule id="528220" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/timesheets/</url>
    <match>PATCH</match>
    <regex>(/restart|/duplicate)$</regex>
    <description>CVE-2026-52822: Kimai timesheet restart/duplicate endpoint invoked (possible stale-authorization abuse)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED): a single source (OSV) claims the fix, and it has not been independently confirmed. Treat the upgrade version as reported-rather-than-verified until validated against the vendor changelog.

1. Immediate mitigations:

   • Restrict or monitor access to PATCH /api/timesheets/{id}/restart and PATCH /api/timesheets/{id}/duplicate, and to the web-based duplicate workflow, at the WAF/reverse-proxy layer if patching cannot be done immediately.
   • Audit recent restarts/duplications of historical timesheets, particularly those referencing projects or activities the acting user is no longer assigned to.
   • Immediately remove or disable accounts whose project/activity access has been revoked, reducing the pool of stale-capability holders. (Note: this limits but does not fix the underlying authorization gap.)

2. Patch/upgrade steps:

   • Upgrade Kimai to version 2.58.0 or later, per the OSV-claimed fix.
   • Verify the fix independently (e.g., re-test that a user removed from a project can no longer restart/duplicate a referencing historical timesheet via API or web UI).

3. Long-term hardening:

   • Enforce current-state authorization checks on all state-creating operations that derive from historical records; authorization must validate present team access to the referenced project and activity, not merely record ownership/visibility.
   • Adop