CVE-2026-52828

Executive Summary

CVE-2026-52828 is a broken access control (authorization bypass) vulnerability in Kimai, an open-source time-tracking application, affecting versions prior to 2.58.0. The ExportController::createExportTemplate() and ExportController::editExportTemplate() methods enforce only the class-level create_export permission — which the default ROLE_TEAMLEAD role receives — instead of the more restrictive create_export_template permission enforced by the corresponding API routes and user interface. A teamlead-level user can therefore reach the export-template creation and editing web routes directly and create or modify global ExportTemplate records available to all users, including administrators. This is an authenticated privilege escalation / integrity-impact issue rather than a remote unauthenticated compromise.

Technical Analysis

The vulnerability is a classic missing function-level access control (CWE-862) — specifically a permission granularity mismatch between the web controller and the API/UI layer. In Kimai, access control is enforced via Symfony-style permission attributes. The API routes and the user interface gate export-template creation/editing behind the create_export_template permission. However, the web controller methods ExportController::createExportTemplate() and ExportController::editExportTemplate() are annotated only with the class-level create_export permission.

Because ROLE_TEAMLEAD is granted create_export by default, any teamlead can bypass the intended UI/API constraint by navigating directly to the underlying web route for the controller methods. The endpoint accepts writes to a shared, global resource — ExportTemplate records — which are marked as available to all users. An attacker with teamlead rights can therefore:

• Create new global export templates.
• Modify existing global export templates.
• Alter the export columns, renderer, format, and output consumed by other users and administrators.

This is not a memory-corruption or injection defect; the flaw is purely in the authorization layer. The confidentiality impact is low (the attacker reads nothing sensitive beyond the template metadata they can already see), the integrity impact is high (shared administrative configuration is modified), and availability remains unaffected. No public PoC, Nuclei template, or exploit code is currently available, and no CISA KEV listing exists. EPSS is low (0.00356, 29.1st percentile), indicating limited observed exploitation — consistent with the fact that authentication at ROLE_TEAMLEAD level is a prerequisite.

Attack surface:

• Authenticated web endpoints reachable by teamlead users.
• State-changing operations on ExportTemplate records shared globally.
• Cross-user impact — templates used by administrators, which materially raises the privilege-escalation value of the bug.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the NVD description and standard CWE-862 behavior.

1. Reconnaissance / target identification. An attacker identifies a Kimai instance and obtains or is provisioned a valid account with ROLE_TEAMLEAD — the default role for team leads in the affected versions. The attacker enumerates reachable web routes and notes that the export-template creation/editing routes are reachable despite not being exposed in the UI/API under their permission set.

2. Triggering the flaw (authorization bypass). The attacker crafts a direct HTTP request to the export-template creation or editing web route corresponding to ExportController::createExportTemplate() or ExportController::editExportTemplate(). Because these controller methods enforce only create_export (held by ROLE_TEAMLEAD), the request is authorized, bypassing the create_export_template permission that the API and UI require.

3. Payload / execution at the vulnerability-class level. The request body contains parameters describing the export template: column selection, renderer, format, and output options. The controller writes the resulting ExportTemplate record, marked as available to all users. An analogous request to the edit route modifies an existing template. No code execution or injection is required — the "payload" is simply a validly-formed state-changing request that the authorization layer incorrectly accepts.

4. Post-exploitation impact. The manipulated template is now presented to other users and administrators. Subsequent exports generated by those users will use the attacker-influenced columns, renderer, format, and output — enabling data exfiltration shaping (e.g., ensuring sensitive columns appear in exports), tampering with administrative reporting, or producing malformed exports that disrupt workflows. Persistence is trivial because the template remains stored globally until an administrator notices and reverts it.

Impact Assessment

• Confidentiality: Low — the attacker does not gain read access to resources beyond their existing role; however, shaping exported output can indirectly leak column data to other recipients.
• Integrity: High — the attacker modifies shared, global administrative configuration (ExportTemplate records) used across users and administrators.
• Availability: None — no denial-of-service mechanism is described.
• Blast radius: Every user and administrator of the affected Kimai instance whose exports use templates created, modified, or selected by the attacker. This is a shared-resource integrity compromise, not merely a per-account issue.
• Privilege required: Authenticated as ROLE_TEAMLEAD (default role). No unauthenticated access is required, which substantially limits internet-scale exposure compared to pre-auth flaws. EPSS and the absence of KEV/PoC data align with this constrained exposure.
• Business impact: Potential data-handling and reporting integrity violations (e.g., manipulated time/expense exports submitted for billing or compliance), loss of trust in exported reports, and remediation cost from reverting template changes.

Detection Guidance

Sigma Rule

title: Kimai ExportTemplate Privilege Bypass (CVE-2026-52828)
id: 1a6c9d4e-5282-8b7f-0000-kimai202652828
status: experimental
description: Detects direct access to Kimai export-template create/edit web routes by teamlead users that bypass the create_export_template permission check.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-52828
author: Threat Intelligence - valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_uri:
    cs-uri-stem|contains:
      - '/export/template/create'
      - '/export/template/edit'
      - '/exporttemplate'
  selection_export:
    cs-uri-stem|contains: 'export'
    cs-uri-stem|contains: 'template'
  condition: selection_method and (selection_uri or selection_export)
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrators with create_export_template permission using the UI
  - Normal UI navigation that maps to the same route
level: medium
tags:
  - attack.t1190
  - cve.2026.52828
  - cwe.862

YARA Rule

rule CVE_2026_52828_Kimai_ExportTemplate_Bypass
{
    meta:
        author = "Threat Intelligence - valtersit.com"
        description = "Detects Kimai ExportController export-template handling referencing the vulnerable permission mismatch (CVE-2026-52828)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-52828"
        date = "2026-01-01"
        cve = "CVE-2026-52828"

    strings:
        $c1 = "createExportTemplate" ascii wide
        $c2 = "editExportTemplate" ascii wide
        $c3 = "ExportController" ascii wide
        $c4 = "create_export_template" ascii wide
        $c5 = "create_export" ascii wide
        $c6 = "ExportTemplate" ascii wide

    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x464C457F or true) and
        (($c1 and $c2) or ($c3 and $c5 and $c6)) and $c4
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-52828 Kimai ExportTemplate authorization bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"export"; http.uri; content:"template"; nocase; http.uri; pcre:"/\/export[^\?]*template/i"; reference:cve,2026-52828; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-52828; classtype:attempted-user; sid:5282801; rev:1; metadata:service http, affected_product Kimai, attack_target Web_Server, deployment Perimeter, signature_severity Major;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [ http where http.request.method in ("POST","PUT","PATCH") and
      wildcard(http.request.path, "/export*template*") and
      wildcard(user.roles, "ROLE_TEAMLEAD") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval path=lower(uri_path)
| where (match(path,"export") AND match(path,"template") AND (method="POST" OR method="PUT" OR method="PATCH"))
| search user!="*ROLE_ADMIN*" AND user!="*ROLE_SUPER_ADMIN*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, method, uri_path
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,kimai,cve-2026-52828,">
  <rule id="528280" level="10">
    <if_sid>31100</if_sid>
    <match>export</match>
    <match>template</match>
    <regex type="pcre2">(?i)(POST|PUT|PATCH)\s+/export[^\s]*template</regex>
    <description>CVE-2026-52828: Possible Kimai ExportTemplate authorization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_52828,access_control_bypass,</group>
  </rule>
  <rule id="528281" level="12">
    <if_sid>528280</if_sid>
    <match>ROLE_TEAMLEAD</match>
    <description>CVE-2026-52828: Teamlead user reaching export-template route (privilege check needed)</description>
    <group>cve_2026_52828,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims the issue is fixed in 2.58.0; this has not been independently confirmed by NVD, and no vendor advisory, commit hash, or patch file reference is provided in the available data. Treat the patch as probable but requiring verification against the Kimai 2.58.0 release notes and the upstream fix commit before relying on it.

1. Immediate mitigations (pre-patch / interim):

   • Restrict ROLE_TEAMLEAD assignments: audit who currently holds teamlead rights and remove the role from users who do not strictly require it.
   • If the reverse proxy or WAF allows it, block direct external access to the export-template create/edit web routes for non-administrator sessions, or require administrator session context on those routes.
   • Monitor web access logs for teamlead users hitting export/template routes (see Detection Guidance).
   • Consider temporarily disabling the export-template feature at the application config level if feasible without breaking required workflows.

2. Patch / upgrade steps:

   • Upgrade Kimai to 2.58.0 or later — this is the version claimed to remediate the issue by applying the create_export_template permission to ExportController::createExportTemplate() and ExportController::editExportTemplate().
   • Verify the fix by confirming the permission check on those controller methods post-upgrade.
   • Re-test that ROLE_TEAMLEAD cannot reach the routes and that the UI/API behavior is unchanged for admins.
   • Because patch confidence is only 2/4, cross-check the Kimai 2.58.0 release notes / upstream commit for the exact change before closing the ticket.

3. Long-term hardening:

   • Enforce fail-closed, method-level permission checks on all state-changing controller methods, not just class-level permissions.
   • Add automated authorization tests that assert ROLE_TEAMLEAD (and every non-admin role) cannot reach privileged web routes.
   • Adopt a periodic access-review process for default roles, and log authorization-denied events for alerting.
   • Apply the principle of least privilege to roles granted teamlead by default.

References

1. NVD — CVE-2026-52828: https://nvd.nist.gov/vuln/detail/CVE-2026-52828
2. OSV Advisory (patch source; fixed in 2.58.0): https://osv.dev/vulnerability/CVE-2026-52828
3. Kimai Project (upstream): https://www.kimai.org/
4. Kimai Releases (verify 2.58.0 fix): https://github.com/kimai/kimai/releases
5. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing at the time of writing. EPSS 0.00356 (29.1st percentile) indicates low predicted exploitation. No known threat actor campaigns are associated with this CVE in the supplied data.