CVE-2026-80193

Executive Summary

CVE-2026-80193 is a missing authorization vulnerability in the Kimai time-tracking application affecting all versions prior to 2.62.0. The flaw resides in the QuickEntry controller, where the application fails to enforce the create_other_timesheet permission when processing QuickEntry form submissions. Authenticated users possessing only view_other_timesheet and edit_other_timesheet permissions can exploit this gap to create timesheet records on behalf of other team members, effectively bypassing the authorization checks that are enforced elsewhere in the application.

The vulnerability carries a CVSS score of 8.8 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that a low-privileged authenticated user can achieve high impact on confidentiality, integrity, and availability without requiring user interaction. The affected component is network-accessible, and the attack complexity is low, making this a realistic target for insider abuse or lateral movement within an organization that self-hosts Kimai. No public proof-of-concept or in-the-wild exploitation has been documented at this time, and the vendor has not yet released a patched version, leaving all deployments prior to 2.62.0 vulnerable.

Technical Analysis

The vulnerability class is CWE-862 — Missing Authorization. The NVD description explicitly identifies Kimai (versions before 2.62.0) as the affected product and pinpoints the QuickEntry controller as the vulnerable component. The description states that the application "fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets."

The authorization logic within Kimai's permission model is designed to gate operations according to a set of granular permissions. In the case of timesheet management, the application maintains distinct permissions: a user with create_other_timesheet is authorized to create records for team members, while view_other_timesheet and edit_other_timesheet grant read and modify access to other users' records, respectively. Those latter permissions do not by design confer the right to create new entries for others.

The specific flaw is that the QuickEntry controller — a convenience feature designed for rapid timesheet logging — fails to invoke the same permission check that is applied in other timesheet-creation controllers or services. This is a classic case of inconsistent authorization enforcement across code paths: the application's core service layer likely validates permissions correctly, but the QuickEntry controller short-circuits the creation process and directly persists the new timesheet entity without consulting the create_other_timesheet permission.

At a code level, this implies that the controller's create or submit action binds the request payload (likely containing a user/team-member identifier and timesheet fields) directly to a new Timesheet entity, then calls the persistence layer without an intervening $this->isGranted('create_other_timesheet') check or equivalent authorization guard. The result is that any authenticated user who has been granted view_other_timesheet and edit_other_timesheet (roles that are commonly assigned to team leads, project managers, or administrators with partial oversight) can create fabricated time entries for other users.

The attack surface is the HTTP-facing QuickEntry form, likely exposed at a route such as /quick_entry or /quick-entry (though the exact path is not disclosed in the NVD description and should not be assumed). The attack is carried out over a network with no user interaction required, and the precondition is simply having a low-privileged authenticated account that holds the two listed permissions. The vulnerability is distinguished by its privilege escalation nature — the attacker gains a capability (creating other users' records) that the permission model explicitly denies them.

No additional technical detail is available from the provided data; the description is sparse on function names, request parameters, or exact URL endpoints beyond the QuickEntry controller identifier. Analysis beyond this point is at the vulnerability-class level.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-80193, and no in-the-wild exploitation has been observed. The following attack chain is inferred from the vulnerability class and the permissions model described in the NVD entry.

Step 1 — Reconnaissance / Target Identification: An attacker who is already an authenticated low-privileged user of a Kimai instance (version < 2.62.0) identifies that their account holds view_other_timesheet and edit_other_timesheet permissions — a typical configuration for team managers or project coordinators. The attacker maps the application's surface, locating the QuickEntry form (a common UI element in Kimai for rapid logging). The attacker also enumerates valid team-member user IDs from the application's user directory, accessible due to the view_other_timesheet permission.

Step 2 — Triggering the Flaw: The attacker navigates to the QuickEntry form and selects a victim team member from the user list. They populate the form with fabricated timesheet data — e.g., nonexistent hours, arbitrary project/task IDs, backdated or future dates. Because the QuickEntry controller does not validate the create_other_timesheet permission, the form submission is accepted without authorization checks that would be enforced on a different creation route (e.g., the standard "New Timesheet" form).

Step 3 — Payload / Execution Method: At the vulnerability-class level, the trigger is a crafted HTTP POST request to the QuickEntry endpoint containing a user parameter (or equivalent) set to the victim's user ID, along with timesheet fields (start time, end time, duration, project, activity). No SQL injection, XSS, or other injection technique is required — the flaw is purely a missing authorization check on a valid application feature. The request may be issued via the web UI or programmatically using a tool like curl, with the attacker's session cookies. The server processes the request and persists the new timesheet record linked to the victim's account.

Step 4 — Post-Exploitation Impact: The consequences are twofold:

• Integrity & billing fraud: Fabricated timesheets inflate reported hours for team members, enabling payroll fraud, false invoicing, or manipulation of project cost tracking. For example, an attacker could attribute overtime hours to a colleague to damage their credibility, or add hours to a project to drain a budget.
• Availability & denial: Mass creation of bogus timesheet records could bloat the database, degrade application performance, and disrupt legitimate timesheet reviews and approvals, causing operational disruption.

The attacker does not gain direct administrative access, but the capability to alter timesheet data for other users inherently undermines the trust integrity of the entire time-tracking system. Because the attacker is already authenticated with legitimate credentials, this is primarily an insider-threat scenario, though a compromised low-privilege account (e.g., via credential stuffing) would equally enable the exploit.

Impact Assessment

CVSS Analysis: The assigned score of 8.8 (High) reflects: AV:N (network-accessible), AC:L (no special conditions), PR:L (requires low-privileged account), UI:N (no user interaction), and high impact across C:H/I:H/A:H. The confidentiality impact is notable because timesheet data can reveal sensitive project allocation and staffing information, and the attacker can additionally create records that misrepresent activity. Integrity impact is the primary concern — fabricated timesheets corrupt the core data used for billing and payroll. Availability impact stems from the potential to flood the system with invalid records, impacting performance and administrative overhead.

Business Impact: For enterprises self-hosting Kimai, the direct impacts include: (1) inaccurate payroll and client invoicing leading to financial loss; (2) corruption of project accounting and utilization metrics; (3) loss of trust in workforce-management data, potentially triggering audits and compliance issues where timesheets are legally mandated (e.g., defense contracts, government grants); (4) reputational damage if billing discrepancies are discovered by clients. For SaaS providers offering Kimai as a managed service, the flaw enables tenant-to-tenant data manipulation and could be exploited by one customer to corrupt another customer's data if user isolation is not properly enforced (this depends on the hosting configuration, not automatically implied).

Blast Radius: The vulnerability affects only authenticated users with both view_other_timesheet and edit_other_timesheet permissions. Users with neither permission (standard employees) cannot exploit the flaw. However, given that these permissions are commonly granted to middle-management roles, the effective blast radius is significant within a typical deployment — any manager-tier account is a potential threat actor. The blast radius is further widened by the fact that no patch is currently available, extending the exposure window indefinitely until the vendor releases 2.62.0.

Detection Guidance

The following detection content is designed to identify exploitation attempts or scanning behavior associated with CVE-2026-80193. As the vulnerability is an authorization bypass on a legitimate feature, detection relies on behavioral anomalies — observing timesheet creation activity that deviates from normal user patterns — rather than on distinctive attack signatures.

Sigma Rule

The Sigma rule detects a single authenticated user creating timesheet records for multiple distinct other users within a short window, which is the hallmark of bulk exploitation of this flaw.

title: Kimai Bulk Timesheet Creation for Multiple Users via QuickEntry
id: 3c8b5f2a-7d19-4c6e-b0a1-8f4d2c6e9a0b
status: experimental
description: Detects a Kimai user creating timesheet records for multiple distinct users in a short time frame, indicating potential exploitation of CVE-2026-80193 (missing create_other_timesheet authorization check).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-80193
author: ValtersIT Threat Intelligence
date: 2026/02/15
logsource:
    category: application
    product: kimai
    service: web
detection:
    selection:
        EventName: 'timesheet.created'
        ActorType: 'user'
    filter_normal_user:
        ActorTargetUsername|equals: ActorUsername   # legitimate self-entry
    condition: selection and not filter_normal_user
    timeframe: 5m
    aggregation:
        field: ActorUsername
        function: count_distinct
        value: 3
fields:
    - ActorUsername
    - ActorTargetUsername
    - HTTP_User_Agent
    - Source_IP
falsepositives:
    - Legitimate team managers with create_other_timesheet permission bulk-entering hours on behalf of team.
    - Data migration or administrative cleanup scripts.
level: high

YARA Rule

The YARA rule targets HTTP request patterns in web server access logs or proxy logs that indicate the QuickEntry endpoint being invoked with a user parameter that differs from the authenticated session user.

rule CVE_2026_80193_Kimai_QuickEntry_Abuse
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP requests to Kimai QuickEntry controller attempting to create timesheets for a different user"
        cve = "CVE-2026-80193"
        date = "2026-02-15"
        score = 70
    strings:
        $quick_entry_path = /quick[_\-]?entry/i
        $user_param = /[?&]user[=]\d+/ nocase
        $timesheet_param = /[?&](?:duration|begin|end|hour)[=]/ nocase
        $post_method = "POST"
        $session_cookie = "MOCKSESSID"  // Kimai uses Symfony session cookies; adjust to actual cookie name
    condition:
        $post_method at 0 and
        $quick_entry_path and
        $user_param and
        $timesheet_param and
        #session_cookie >= 1
}

Suricata IDS Rule

This Suricata rule flags HTTP requests to the Kimai QuickEntry endpoint that contain a user parameter — a strong indicator of someone attempting to create entries for another user, especially if combined with a Referer indicating the QuickEntry form.

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Kimai QuickEntry Controller - Potential Authorization Bypass CVE-2026-80193"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/quick"; nocase; http.uri; content:"entry"; nocase; http.request_body; content:"user"; nocase; http.request_body; content:"="; within:50; http.request_body; content:"!"; within:50; sid:202680193; rev:1; metadata:attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2026_02_15, cve CVE_2026_80193; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-80193;)

Elastic Detection

The Elastic EQL rule correlates web server audit logs (e.g., Nginx/Apache with mod_security) and Kimai application logs to detect a user creating timesheet records for three or more distinct target users within five minutes.

sequence by source.ip with maxspan=5m
  [ web where http.request.method == "POST" and url.path like "*quick*entry*" and
    user.name != null ]
  [ audit where event.action == "application_log" and process.name == "kimai" and
    message like "timesheet.created*" ]
  [ audit where event.action == "application_log" and message like "*forOtherUser*" ]
  | stats distinct_counts = cardinality(user.target_name) by user.name
  | where distinct_counts >= 3

Splunk SPL Query

The Splunk query searches application and web logs for a given authenticated user targeted timesheet creation for distinct usernames, aggregating on source IP to spot anomalous mass creation.

index=kimaiapp OR index=webserver
| where match(eventtype, "kimai_timesheet_create")
| eval target_user = mvindex(upper(username), 0), actor_user = coalesce(sourcetype_user, NOT(NOT http_user))
| search eventtype="timesheet_creation" AND NOT target_user = actor_user
| chart count BY user target_user
| where count > 5
| sort - count
| table _time, src_ip, user, target_user, count, http_user_agent

Wazuh OSSEC Rule

The Wazuh XML rule triggers a high-severity alert when Kimai application logs show a single actor user creating timesheets for multiple distinct other users in a short time window.

<group name="kimai,">
  <rule id="459781" level="13">
    <decoded_as>kimai</decoded_as>
    <field name="event">timesheet.created</field>
    <description>Kimai: Potential CVE-2026-80193 exploit - QuickEntry timesheet creation for other user</description>
    <group>kimai,billing,fraud,</group>
    <var name="actor">user</var>
    <var name="target">target_user</var>
    <field name="target">!same_as_actor</field>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="459782" level="15" frequency="3" timeframe="300">
    <if_matched_sid>64920</if_matched_sid>
    <same_field>user</same_field>
    <description>Kimai: Multiple timesheet creations for different users in 5 minutes - CVE-2026-80193 exploitation pattern</description>
    <group>kimai,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vulnerability is UNPATCHED (Patch Confidence: 0/4). The NVD description references version 2.62.0 as the fixing version, but no patch, advisory, or release evidence is available in any tracked source at this time. The vendor has not yet disclosed any interim workarounds.

1) Immediate Mitigations (while awaiting vendor patch):

• Restrict permissions: Audit all user roles and remove view_other_timesheet and edit_other_timesheet permissions from any user who does not strictly require them. This shrinks the exploit population to those who genuinely need those privileges.
• Monitor QuickEntry usage: Enable detailed application logging and watch for anomalous timesheet-creation patterns using the detection rules above. Any user creating entries for three or more other users within a 5-minute window warrants manual review.
• Application-layer filtering: If a reverse proxy or WAF is in place, consider a temporary custom rule to block POST requests to the QuickEntry endpoint that include a user parameter differing from the session user. (Note: this may break legitimate functionality for users with the correct permission.)
• Database-level audit: Implement a database trigger or scheduled job to flag timesheet records where author != actor and the actor lacks the create_other_timesheet role, raising an alert.

2) Patch / Upgrade Steps:

• Monitor the official Kimai releases page (https://github.com/kimai/kimai/releases) for version 2.62.0.
• Back up the database and application files before any upgrade.
• Upgrade to Kimai 2.62.0 or later as soon as it becomes available. Until then, there is no patched version to deploy.

3) Long-Term Hardening:

• Principle of least privilege: Review all role-permission mappings on a semiannual basis; ensure no user holds wide permissions by default. Consider introducing a dedicated role for "view-only others" that does not include edit or create capabilities.
• Multi-factor authentication: Enforce MFA for all privileged and manager-tier accounts, reducing the risk of exploitation via credential compromise.
• Web application firewall: Deploy a WAF with virtual patching rules that block suspicious QuickEntry patterns in the absence of a vendor patch.
• Security awareness: Educate timekeeping staff that timesheet data is subject to integrity checks; encourage managers to report unexpected records.
• Independent security review: Conduct a code review of the QuickEntry controller and other high-traffic controllers to identify other potential authorization gaps that may share the same root cause.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-80193 — Official NIST National Vulnerability Database record containing the CVSS score, CWE classification, and NVD description.
2. Kimai Official Site: https://www.kimai.org — Vendor product page; monitor for security advisories and version announcements.
3. Kimai GitHub Releases: https://github.com/kimai/kimai/releases — Track the release of version 2.62.0, the referenced fixing version.
4. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html — MITRE Common Weakness Enumeration definition for the vulnerability class.
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — ATT&CK technique mapping for the exploitation of internet-facing application flaws.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None documented as of this writing. No CISA KEV listing, no public exploit code (Metasploit, Exploit-DB), and no Nuclei template exists for CVE-2026-80193. The absence of current exploitation should not reduce scrutiny — historically, Kimai vulnerabilities of similar class have been targeted by botnets and automated scanners once disclosed. The lack of a patch increases the window of opportunity for attackers who monitor security feeds.