CVE-2026-52826

Executive Summary

CVE-2026-52826 is an improper authorization vulnerability (CWE-285) in the open-source time-tracking application Kimai, affecting versions prior to 2.57.0. An authenticated user with edit rights on a single parent object (project, customer, or activity) can pair that authorized parent with a rate record belonging to a different, unauthorized parent and persist billing-configuration changes. The impact is unauthorized modification of billing/rate data — an integrity violation with financial and reporting implications — rather than data theft or code execution.

Technical Analysis

Kimai exposes administrative rate-management endpoints at /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admin/activity/{id}/rate/{rate} for configuring ProjectRate, CustomerRate, and ActivityRate records respectively. Per the NVD description, GET or POST requests to these endpoints "independently resolve the authorized parent identifier and the attacker-selected child rate identifier without confirming that the ProjectRate, CustomerRate, or ActivityRate belongs to that parent."

The defect is an ownership/linkage validation gap: the code path checks authorization against the parent object identified by {id}, but the child rate identified by {rate} is looked up independently and never verified to belong to that parent. This is a classic case of a broken object-level authorization/linkage (CWE-285, Improper Authorization). Because the two identifiers are resolved separately and the relational binding between them is not validated, the parent's authorization context is effectively "borrowed" to mutate an unrelated rate record.

Successful exploitation writes to the persistence tables kimai2_projects_rates, kimai2_customers_rates, or kimai2_activities_rates, altering stored billing configuration. The attack requires authentication and the ability to edit at least one parent object, but does not require access to the victim parent object's own rate records — only knowledge (or enumeration) of the target rate {rate} identifier. No public proof-of-concept, Nuclei template, or exploit code is available. The fix is claimed in version 2.57.0 per a single source (OSV); patch confidence is 2/4 and the fix should be independently validated by comparing parent/child binding logic in the rate controllers before relying on it.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the endpoint semantics stated verbatim in the NVD description.

1. Reconnaissance / target identification. The attacker authenticates with a low-privilege account that holds edit rights on at least one project, customer, or activity. They enumerate rate identifiers belonging to other (unauthorized) parent objects. The three vulnerable routes accept {id} (authorized parent) and {rate} (attacker-selected child); the attacker controls both parameters and can substitute a rate ID that does not belong to the parent named in the URL.
2. Triggering the flaw class. The attacker issues a GET or POST request to one of the three endpoints, using an {id} for a parent they are authorized to edit and a {rate} that belongs to a target they are not authorized to touch. Because the server validates the parent but never verifies the rate-to-parent ownership relationship, the authorization check passes.
3. Execution method. The request carries the attacker-controlled rate identifier in the {rate} path segment. No special payload is required — the "payload" is the mismatched identifier pairing itself. On POST, the accepted parameters are persisted to the corresponding kimai2_*_rates table.
4. Post-exploitation impact. Billing configuration for an unauthorized project, customer, or activity is silently modified — rates, and by extension invoicing or cost calculations, can be altered. The change is persistent and could bias financial reporting, under- or over-bill customers, or corrupt business data until corrected. There is no reported confidentiality impact, code execution, or privilege escalation beyond the rate records the attacker can reach.

Impact Assessment

This is an integrity-focused authorization bypass. Applying the inferred CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5 class), the network attack vector and low complexity mean it is remotely reachable via the web interface; the low privileges requirement limits it to authenticated users; no user interaction is needed. Confidentiality is unaffected (C:N) and availability is unaffected (A:N) because the defect writes configuration rather than exposing or destroying data. However, integrity is High (I:H): unauthorized, persistent modification of billing rates directly affects financial accuracy — invoices, cost allocation, customer charges, and reporting can all be manipulated. The blast radius is bounded by the number of rate records an attacker can enumerate and the parent objects they can name, but it is cross-tenant in effect: a user authorized only for project A can alter rates tied to unrelated projects/customers/activities. Note the assigned CVSS score in the intelligence data is N/A; the vector above is an analyst-derived assessment and should be treated as provisional. EPSS is 0.00257 (17.5th percentile), indicating low current exploit likelihood, consistent with the absence of public exploitation and non-KEV status.

Detection Guidance

Detection should focus on correlating an authenticated session's parent-edit rights with requests that reference rate identifiers inconsistent with the authorized parent. Because the flaw is logical, application-aware logging (recording both {id} and {rate} and their expected ownership) is required for high-fidelity detection; network-layer rules can only flag anomalous patterns.

Sigma Rule

title: Kimai Rate Endpoint Parent/Child Mismatch (CVE-2026-52826)
id: 8f5c1a2e-kimai-52826
status: experimental
description: Detects access to Kimai rate endpoints where the child rate identifier may not belong to the referenced parent, indicating an authorization bypass attempt.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52826
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|re: '^/(en/)?admin/(project|customer|activity)/\d+/rate/\d+'
  selection_method:
    cs-method:
      - GET
      - POST
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrators editing rate records for the correct parent
level: medium

YARA Rule

rule CVE_2026_52826_Kimai_Rate_IDOR
{
    meta:
        author = "valtersit.com"
        description = "Detects Kimai rate-management endpoint patterns associated with CVE-2026-52826 authorization bypass in web logs or artifacts"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52826"
        date = "2026-01-01"
    strings:
        $ep1 = "/admin/project/" ascii nocase
        $ep2 = "/admin/customer/" ascii nocase
        $ep3 = "/admin/activity/" ascii nocase
        $rate = "/rate/" ascii nocase
        $t1 = "kimai2_projects_rates" ascii nocase
        $t2 = "kimai2_customers_rates" ascii nocase
        $t3 = "kimai2_activities_rates" ascii nocase
    condition:
        (($ep1 or $ep2 or $ep3) and $rate) or any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52826 Kimai Rate Endpoint Parent/Child Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; pcre:"/\/admin\/(project|customer|activity)\/[0-9]+\/rate\/[0-9]+/i"; classtype:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-52826; sid:202652826; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where url.path regex~ ".*/admin/(project|customer|activity)/[0-9]+/rate/[0-9]+" and http.request.method in ("GET","POST")]

Splunk SPL Query

index=web sourcetype=access_combined
| regex uri_path="^/(en/)?admin/(project|customer|activity)/[0-9]+/rate/[0-9]+"
| stats count values(uri_path) as targeted_rates values(method) as methods by src_ip user
| where count > 5
| table src_ip user count methods targeted_rates

Wazuh OSSEC Rule

<group name="web,kimai,">
  <rule id="100526" level="8">
    <if_sid>31100</if_sid>
    <id>^31108$</id>
    <match>admin/(project|customer|activity)/\d+/rate/\d+</match>
    <description>CVE-2026-52826: Kimai rate endpoint parent/child mismatch access detected</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The OSV source states the issue is fixed in Kimai 2.57.0, but this has not been independently verified — validate the fix by confirming the rate controllers now enforce that the ProjectRate/CustomerRate/ActivityRate belongs to the parent identified in the URL before persisting changes.

1. Immediate mitigations (if upgrade is not yet possible):
   • Restrict access to the /en/admin/*/rate/* endpoints to fully trusted administrators only, via reverse-proxy access controls or role reduction, minimizing the pool of accounts with parent-edit rights.
   • Add an upstream validation layer (WAF or reverse proxy) is not sufficient for this logical flaw; instead, temporarily restrict the rate-management functionality to a narrow set of named accounts and monitor for anomalous parent/child request pairings.
   • Enable verbose application and web-server logging capturing both {id} and {rate} parameters so mismatched pairings can be identified and investigated.
2. Patch/upgrade steps:
   • Upgrade Kimai to 2.57.0 (or later) following your standard change process; back up the database first.
   • After upgrading, verify the fix by testing that a rate ID belonging to an unauthorized parent is rejected when submitted against an authorized parent's endpoint.
   • Review the kimai2_projects_rates, kimai2_customers_rates, and kimai2_activities_rates tables for unexpected modifications introduced before the patch.
3. Long-term hardening:
   • Enforce object-level authorization (ownership checks) on every child-resource operation, ensuring the child is bound to the authorized parent, not resolved independently.
   • Adopt centralized, tested authorization middleware so rate controllers cannot diverge in access-control logic.
   • Add regression tests specifically covering cross-parent child-object access to prevent reintroduction (CWE-285).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52826
• OSV (patch source): https://osv.dev/vulnerability/CVE-2026-52826
• Kimai project: https://www.kimai.org/
• Kimai releases (2.57.0): https://github.com/kimai/kimai/releases
• CWE-285 — Improper Authorization: https://cwe.mitre.org/data/definitions/285.html

Threat actor / exploit-in-the-wild evidence: None. CISA KEV status is NO, EPSS is 0.00257 (17.5th percentile), and no public PoC, Nuclei template, or exploit code is available as of this report. The attack requires authenticated, low-privilege access and is likely to be an insider-abuse or compromised-account concern rather than an opportunistic external campaign.