CVE-2026-52823

Executive Summary

CVE-2026-52823 is a Cross-Site Request Forgery (CSRF) vulnerability in Kimai, an open-source time-tracking application, affecting all versions prior to 2.58.0. The TimesheetController exposes state-changing operations through GET requests to GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart without any request-forgery defense, allowing a remote attacker to induce a logged-in user's browser to silently stop a running timesheet or restart a historical entry. The impact is integrity-focused: unauthorized manipulation of time records can corrupt billing, reporting, approvals, and audit trails, though no confidentiality or availability loss is directly attributable to the flaw itself.

Technical Analysis

CVE-2026-52823 is classified under CWE-352 (Cross-Site Request Forgery). The root cause is the application's decision to expose state-changing functionality via HTTP GET rather than a safe, idempotent method such as POST, combined with the absence of an anti-CSRF token or equivalent request-forgery defense on those routes.

Per the NVD description, TimesheetController in Kimai versions prior to 2.58.0 exposes two endpoints:

• GET /api/timesheets/{id}/stop — stops a running timesheet.
• GET /api/timesheets/{id}/restart — restarts a historical entry, creating and starting a new timesheet.

Because these operations are reachable via GET and reuse the authenticated browser session cookie, any external page that directs the victim's browser to these URLs will cause the action to execute with the victim's privileges. The application does not appear to enforce a request-forgery defense (e.g., CSRF token, Origin/Referer validation, or custom-header requirement) on these routes.

The attack surface is the web-accessible API path. Attack complexity is low from the attacker's perspective: the only prerequisite is that the victim (a logged-in Kimai user) loads attacker-controlled content containing a request to one of the two endpoints. The vulnerability is network-reachable (AV:N) and requires user interaction (UI:R), consistent with the CSRF class. Because the endpoints are GET-based, they are trivially embeddable in a link, image tag, or other browser-initiated fetch, which broadens the set of delivery vectors.

Critically, no confidentiality impact is implied — the action alters timesheet state rather than exfiltrating data. The integrity impact is scoped to time records and downstream artifacts (billing, reports, approvals, audits). No denial-of-service or code-execution impact is described. The unauthorized restart operation has a compounding effect: it does not merely modify an existing record but creates a new running timesheet from a historical entry, which can distort concurrent entries, billing calculations, and approval workflows.

The CVSS score is reported as N/A in the supplied data. The vector above is an analyst-inferred CVSS v3.1 assessment consistent with the description (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) and should be treated as provisional, not authoritative.

Patch confidence is 2/4 (CLAIMED). A single source (OSV) asserts that the issue is fixed in 2.58.0; this has not been independently corroborated. The OSV package data lists the version range as unfixed (0→unfixed), which is consistent with missing granular version metadata rather than a contradictory claim. Affected versions array is empty, so the effective affected range is inferred as all versions strictly below 2.58.0.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-52823. The following attack chain is inferred strictly from the vulnerability class (CSRF) and the endpoints named in the NVD description. No function names, parameter names, or paths beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a Kimai instance reachable over the network and confirms the presence of the API routes for timesheet stop/restart. Because these are GET-accessible endpoints under /api/timesheets/{id}/, an attacker can enumerate plausible {id} values without authentication to the target, though the operation only succeeds in the context of an authenticated session.

2. Triggering the flaw class. The attacker crafts attacker-controlled content — for example, a malicious web page, a link, or an embedded resource — that causes the victim's browser to issue a GET request to either /api/timesheets/{id}/stop or /api/timesheets/{id}/restart. Since the request is a same-site GET initiated by the browser, the victim's authenticated session cookie is attached automatically, and the application — lacking a request-forgery defense on these routes — processes the state-changing operation.

3. Payload/execution at the class level. No malicious payload beyond the crafted URL is required. The "exploit" is the browser navigation/fetch itself; the state change is performed by the application on behalf of the victim. For stop, the attacker supplies the {id} of an active timesheet; for restart, the {id} of a historical entry, which the application converts into a new running timesheet.

4. Post-exploitation impact. The victim's time records are silently altered. A stopped timesheet under-reports active work; a restarted historical entry over-reports by creating a new running entry. Downstream, this corrupts billing totals, reporting accuracy, approval queues, and audit evidence. Because the actions occur without the user's consent or awareness, detection depends on auditing timesheet mutations rather than user reports. The attacker gains no direct code execution or data exfiltration from this flaw.

Impact Assessment

The blast radius is confined to integrity of timesheet and derived data within the affected Kimai instance. Systems impacted include any deployment running Kimai < 2.58.0 with authenticated users who may load external content while logged in.

Referencing the inferred CVSS subscores:

• Confidentiality (C:N): No data disclosure is described.
• Integrity (I:L): Timesheet state can be modified without authorization, affecting records, billing, reports, approvals, and audits. The scope is limited to the application's own data.
• Availability (A:N): No service disruption is described; stopping a timesheet is not equivalent to a DoS.
• Scope (S:U): Impact remains within the vulnerable component.
• Attack Vector (AV:N) / Complexity (AC:L) / Privileges (PR:N) / User Interaction (UI:R): Network-reachable, low complexity, no attacker privileges, but requires a victim to load attacker-controlled content.

Business impact centers on billing accuracy and audit integrity in organizations that rely on Kimai for time and invoicing. In consulting, legal, and contracting contexts, manipulated time records can directly affect invoices, client trust, and compliance evidence. EPSS is 0.00213 (11.8th percentile), indicating low predicted exploitation likelihood in the near term; there is no evidence of CISA KEV listing or active exploitation.

Detection Guidance

Sigma Rule

title: Kimai CSRF Timesheet Stop/Restart via GET
id: 9a1c7f2e-5282-3cve-2026-5282-0001
status: experimental
description: Detects access to Kimai timesheet stop/restart GET endpoints, which are vulnerable to CSRF prior to 2.58.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52823
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_path_stop:
    cs-uri-stem|contains: '/api/timesheets/'
    cs-uri-stem|endswith: '/stop'
  selection_path_restart:
    cs-uri-stem|contains: '/api/timesheets/'
    cs-uri-stem|endswith: '/restart'
  selection_referer:
    cs-referer|notstartswith: 'https://%HOSTNAME%'
  condition: selection_method and (selection_path_stop or selection_path_restart) and selection_referer
falsepositives:
  - Legitimate UI actions originating from external dashboards
  - Browser extensions or API clients with unusual Referer headers
level: medium
tags:
  - attack.t1204.001
  - cwe.352

YARA Rule

rule CVE_2026_52823_Kimai_CSRF_Timesheet
{
    meta:
        description = "Detects references to Kimai timesheet stop/restart GET endpoints associated with CVE-2026-52823 CSRF"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52823"
        cve = "CVE-2026-52823"

    strings:
        $ep1 = "/api/timesheets/" ascii wide nocase
        $ep2 = "/stop" ascii wide nocase
        $ep3 = "/restart" ascii wide nocase
        $app = "Kimai" ascii wide nocase

    condition:
        $ep1 and (($ep2 and #ep2 > 0) or ($ep3 and #ep3 > 0)) and $app
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52823 Kimai CSRF Timesheet Stop/Restart GET Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/timesheets/"; http.uri; content:"/stop"; nocase; http.referer; content:"!Kimai"; sid:5282301; rev:1;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ network where http.request.method == "GET"
      and http.request.uri : "/api/timesheets/*"
      and (http.request.uri : "*/stop" or http.request.uri : "*/restart") ]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path="/api/timesheets/*"
| where match(uri_path, "/(stop|restart)$")
| eval csrf_suspect=if(isnull(referer) OR NOT match(referer, "https?://[^/]*kimai"), 1, 0)
| where csrf_suspect=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, referer, status
| sort - count

Wazuh OSSEC Rule

<group name="web,kimai,csrf,">
  <rule id="528230" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/api/timesheets/</match>
    <regex>:GET /api/timesheets/[^ ]+/(stop|restart)</regex>
    <description>CVE-2026-52823: Possible Kimai CSRF timesheet stop/restart via GET request</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
    <group>cve_2026_52823,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations (if upgrade is not yet possible):

   • Restrict access to the Kimai API routes /api/timesheets/{id}/stop and /api/timesheets/{id}/restart at the reverse proxy or WAF so that requests lacking a valid same-origin Referer/Origin or a required custom header are rejected.
   • Enforce Origin/Referer validation and SameSite cookie attributes at the proxy layer to reduce cross-site request delivery.
   • Limit the exposure of the Kimai instance to trusted networks where feasible.
   • Educate logged-in users not to browse untrusted external content in the same browser session used for Kimai.

2. Patch/upgrade steps:

   • Upgrade Kimai to version 2.58.0 or later, which the OSV source claims addresses the issue. Because the patch is CLAIMED and not independently confirmed, validate the fix in a staging environment by confirming that /api/timesheets/{id}/stop and /api/timesheets/{id}/restart no longer execute state-changing operations without a request-forgery defense.

3. Long-term hardening:

   • Enforce that all state-changing operations use POST (or other non-idempotent methods) with anti-CSRF tokens, and reject GET-based mutations.
   • Apply the principle of safe HTTP methods consistently across the API.
   • Instrument auditing and alerting on timesheet stop/restart events to catch unauthorized changes early.
   • Monitor vendor advisories for confirmation of the fix and any further revisions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52823
• OSV: https://osv.dev/vulnerability/CVE-2026-52823
• Kimai project: https://www.kimai.org/
• CWE-352 Cross-Site Request Forgery: https://cwe.mitre.org/data/definitions/352.html
• MITRE ATT&CK T1204.001 — User Execution: Malicious Link: https://attack.mitre.org/techniques/T1204/001/

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-52823 at the time of writing. CISA KEV status: NO. EPSS: 0.00213 (11.8th percentile).