CVE-2026-80202

Executive Summary

CVE-2026-80202 is an access control failure in Kimai, an open-source time-tracking application, affecting all versions prior to 2.56.0. The vulnerability resides in the TimesheetVoter::voteOnAttribute() authorization check, which fails to enforce team-membership validation, allowing any authenticated user holding ROLE_TEAMLEAD (or a role with edit_other_timesheet/delete_other_timesheet permissions) to read, modify, and permanently delete timesheet records belonging to any user across the system via the API. The CVSS score of 8.8 (High) reflects the network-based attack vector, low privilege requirement, and high confidentiality/integrity/availability impact; the flaw is currently unpatched, and no public exploit code or PoC exists at the time of this report.

Technical Analysis

The vulnerability is a broken access control (CWE-863) in Kimai's authorization layer. The affected component is the TimesheetVoter class, specifically its voteOnAttribute() method, which is responsible for deciding whether a user is permitted to perform a given operation (e.g., view, edit, delete) on a timesheet entity. According to the NVD description, the voter maps permissions only to two global attributes: own_timesheet and other_timesheet. This means the codebase categorizes timesheets as either "owned by the current user" or "owned by another user," completely omitting a team-membership context check.

The architectural flaw: even if a timesheet belongs to a different team within the organization, the voter does not differentiate between "timesheet of a user in my team" and "timesheet of a user outside my team." Instead, any user with ROLE_TEAMLEAD (or a role that includes edit_other_timesheet or delete_other_timesheet permissions) is granted access to timesheets classified as "other" — regardless of which team the owner belongs to. The NVD description explicitly states that "any authenticated user with ROLE_TEAMLEAD ... can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership."

Attack surface: The vulnerability is exposed through Kimai's REST API, which mediates all programmatic access to timesheet records. The description notes that "Timesheet IDs are sequential integers and trivially enumerable," meaning an attacker who authenticates as a team lead can enumerate the entire ID space (e.g., GET /timesheets/{id} for id=1,2,3,...) to discover and access all timesheet records in the system. The lack of team-based filtering in the voter leads to object-level authorization failures where the user's declared role permissions (edit_other_timesheet/delete_other_timesheet) are honored without verifying actual data ownership or team membership.

The NVD description also notes: "ROLE_USER accounts are correctly restricted," indicating that the perimeter holds for the least-privileged role, but the team-lead role inherits far broader data access than intended. Notably, the maintainers characterize this behavior as "matching the documented permission model," which suggests that the code intentionally maps team-lead permissions to all "other" timesheets; however, the security community and the NVD assess this as a vulnerability because the documentation does not clearly communicate that team leads can bypass team boundaries.

Insufficient technical detail is available in the description regarding the exact API endpoint paths, HTTP methods, or the specific SQL queries used; however, the vulnerability class (insecure direct object reference combined with broken function-level authorization) is fully established. The sequential nature of timesheet IDs enables trivial enumeration attacks, making the vulnerability easily and rapidly exploitable once an attacker holds a valid low-privilege (team-lead) account.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the following attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker first identifies a Kimai instance. This can be done via Shodan style queries (e.g., http.title:"Kimai") or by fingerprinting the login page and JavaScript bundles. The attacker then needs valid credentials for any account with ROLE_TEAMLEAD (or a role granting edit_other_timesheet/delete_other_timesheet). These credentials may be obtained via phishing, credential stuffing, or insider access. Alternatively, the attacker may register a legitimate account if the deployment allows self-registration and then escalate privileges through other means (out of scope for this CVE, but necessary for this exploit).

Step 2 — Triggering the Authorization Flaw: Once authenticated as the team lead, the attacker calls the Kimai API to enumerate timesheet resources. Because the TimesheetVoter::voteOnAttribute() method maps the permission only to own_timesheet or other_timesheet without a team context, any API request to read or modify a timesheet classified as "other" is authorized purely on the user's role. The attacker does not need to manipulate any special payload or inject malicious data — merely supplying a valid timesheet ID (e.g., sequential enumeration from 1 upward via the API list or GET endpoints) is sufficient.

Step 3 — Payload/Execution: At the request level, the attacker sends authenticated HTTP requests to the timesheet API endpoints. Since the IDs are sequential integers, the attacker can iterate over the entire ID space with automatic scripts. For reading, the attacker issues GET requests (or equivalent list methods) to retrieve timesheet data — including any comments, hourly rates, project assignments, and user identifiers — for all users. For modification, the attacker issues PUT/PATCH requests altering timesheet fields (hours, dates, descriptions, project associations). For deletion, the attacker issues DELETE requests to permanently remove records. The access control failure is entirely server-side; no injection or evasion of network defenses is required.

Step 4 — Post-Exploitation Impact: The data obtained includes: timesheet content revealing which projects users work on, daily work patterns, hours billed, and internal tags/commentary (potentially including confidential client notes). The attacker can weaponize this data for corporate espionage, insider threat recruitment, or blackmail. Modification of timesheet data can inflate or deflate billing records, causing financial fraud or payroll manipulation. Permanent deletion of timesheets destroys audit trails, billing evidence, and historical project data, impacting payroll integrity, client invoicing, and regulatory compliance (e.g., labor law records). In a multi-tenant Kimai deployment, a compromised team lead in one organization could exfiltrate timesheet data from another organization sharing the same instance, escalating the blast radius beyond a single entity.

Impact Assessment

• Business Impact: High. Timesheets are core financial and HR records. Unauthorized read access exposes employee work patterns, client project breakdowns, and potentially confidential billing rates. Modification of timesheets directly corrupts payroll and client invoicing, creating financial disputes and potential legal liability. Permanent deletion destroys auditable records, compromising accounting reconciliation and compliance with labor/employment regulations. • Affected Systems: All Kimai installations running versions prior to 2.56.0 that expose the REST API to authenticated users (the standard default configuration). Any deployment where team leads exist or where the edit_other_timesheet/delete_other_timesheet permissions are granted to any role is at risk. • Blast Radius: System-wide. The NVD description explicitly states the attacker can access timesheets belonging to any user "system-wide" — meaning the vulnerable scope is the entire Kimai instance (all teams, all users), not just a subset. • CVSS Subscores (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): Attack Vector: Network (AV:N) — exploitable remotely over the API; Attack Complexity: Low (AC:L) — no special conditions; Privileges Required: Low (PR:L) — requires only a team-lead account, not admin; User Interaction: None (UI:N); Scope: Unchanged (S:U); Confidentiality: High (C:H) — full read of all timesheet data system-wide; Integrity: High (I:H) — arbitrary modification of all timesheet data; Availability: High (A:H) — permanent deletion of timesheet records. The score of 8.8 is fully justified given the low barrier to entry and total compromise of data confidentiality, integrity, and availability. • Known Exploitation: No evidence of exploitation in the wild has been reported. The CVE is not listed on CISA KEV.

Detection Guidance

Sigma Rule

title: Kimai Timesheet Voter Authorization Bypass — Mass Timesheet Enumeration
id: 4c4f9d4e-8d01-4f2c-9d6a-7a9e5e8b7f11
status: experimental
description: Detects rapid sequential enumeration of timesheet IDs via the Kimai API, indicative of an attacker exploiting CVE-2026-80202 to access timesheets outside their team.
logsource:
    category: application
    product: kimai
detection:
    selection_timeframe:
        api.action: ["timesheet_list", "timesheet_get", "timesheet_edit", "timesheet_delete"]
        http.status_code: 200
        api.user_role: ["ROLE_TEAMLEAD"]
    selection_pattern:
        http.url|contains: "/timesheets/"
        http.url|re: "/timesheets/\d{1,6}$"
    selection_enumeration:
        # Trigger when > 50 distinct URL IDs in 5 minutes from same source
        api.request_count: 50
    condition: selection_timeframe and selection_pattern and selection_enumeration
    timeframe: 5m
level: high
falsepositives:
    - Legitimate bulk exports or admin tools that pull many timesheets at once
    - Automated scripts from the Kimai mobile apps polling recent entries
tags:
    - attack.t1190
    - cve.2026-80202
    - access_control_failure

YARA Rule

rule Kimai_TimesheetVoter_Bypass_CVE_2026_80202
{
    meta:
        author = "Valters IT Security"
        description = "Detects strings in logs or memory dumps referencing Kimai timesheet voter bypass targeting team-membership checks"
        cve = "2026-80202"
        date = "2026-01-01"
    strings:
        $a = "TimesheetVoter" ascii wide
        $b = "voteOnAttribute" ascii wide
        $c = "own_timesheet" ascii wide
        $d = "other_timesheet" ascii wide
        $e = "edit_other_timesheet" ascii wide
        $f = "delete_other_timesheet" ascii wide
        $g = "ROLE_TEAMLEAD" ascii wide
        $h = "/timesheets/" ascii wide
        $i = "team-membership" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or 2 of ($a,$b,$c,$d)) and
        (any of ($e,$f,$g)) and 3 of ($a,$b,$c,$d,$h,$i)
}

Suricata IDS Rule

alert http any any -> $KIMAI_SERVERS any (msg:"KIMAI CVE-2026-80202 Timesheet ID Enumeration Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/timesheets/"; http_uri; pcre:"/\/timesheets\/\d{1,6}$/"; sid:1002802; rev:1; metadata:impact_flag red, cve 2026-80202; reference:url, https://nvd.nist.gov/vuln/detail/CVE-2026-80202; classtype:attempted-user;)

Note: An additional alert for PUT/PATCH/DELETE methods on the same URI pattern may be added to catch modification/deletion attempts, but the enumeration pattern above is the strongest early indicator.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
    url.path rlike "/timesheets/[0-9]{1,6}$" and
    // Identify the API listener
    destination.port == 443 or destination.port == 80 ]
  [ network where http.request.method == "GET" and
    url.path rlike "/timesheets/[0-9]{1,6}$" ]
  [ network where http.request.method == "GET" and
    url.path rlike "/timesheets/[0-9]{1,6}$" ]
  [ network where http.request.method == "GET" and
    url.path rlike "/timesheets/[0-9]{1,6}$" ]
  [ network where http.request.method == "GET" and
    url.path rlike "/timesheets/[0-9]{1,6}$" ]
// Triggers on 5+ enumeration GETs from same source in 5 minutes

Splunk SPL Query

index=wsgi OR index=nginx OR index=access
  (uri="/timesheets/*" OR uri_path IN ("/timesheets")) 
  | regex uri="\/timesheets\/\d{1,6}$"
  | stats count as req_count, dc(uri_path) as distinct_ids by src_ip, user, method, uri
  | where req_count > 30 AND distinct_ids > 20
  | eval severity = "HIGH"
  | table _time, src_ip, user, method, req_count, distinct_ids, uri
  | sort - req_count
  | `send_alert("CVE-2026-80202 Kimai Timesheet Enumeration")`

Wazuh OSSEC Rule

<group name="kimai,">
  <rule id="100802" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.*/timesheets/\d{1,6}$</field>
    <field name="method">^GET$</field>
    <description>CVE-2026-80202: Possible Kimai timesheet ID enumeration (system-wide data access)</description>
    <group>access_control_failure,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <interval>120</interval>
    <if_sid>100801</if_sid>
    <frequency>15</frequency>
    <same_source_ip/>
    <field name="http_response">200|200</field>
    <info>Multiple 200 responses to sequential /timesheets/{id} from same source detected. If source role is ROLE_TEAMLEAD, treat as highly suspicious for CVE-2026-80202.</info>
  </rule>
</group>

Note: The rule above is scaffolding; an operator should define rule id 100801 as a base rule to catch any API request to /timesheets/, and the 100802 rule uses frequency/same_source_ip to detect enumeration.*

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations (while unpatched):
   • Restrict assignment of ROLE_TEAMLEAD and remove the edit_other_timesheet/delete_other_timesheet permissions from all non-trustworthy roles. There is no safe way to combine these permissions without the team-membership check.
   • If the application is internet-facing or accessible from a semi-trusted network, place the Kimai API behind a WAF or reverse proxy that can rate-limit requests per authenticated user, specifically targeting GET/UPDATE/DELETE to the /timesheets/ path with sequential integer patterns.
   • Implement compensating network segmentation: allow API access only from VPN- or trusted-IP ranges to reduce exposure to credential-stuffing attacks.
   • Monitor logs for enumeration patterns and configure alerts on abnormal high-volume timesheet access (see Detection Guidance).
2. Patch/Upgrade Steps:
   • No patch is currently available from the vendor. Upgrade to Kimai version 2.56.0 (the version referenced in the NVD description as containing the fix) as soon as it becomes available or is released.
   • Until then, consider disabling the API endpoints entirely via application configuration if the timesheet API is not strictly required for operations.
3. Long-Term Hardening:
   • Adopt a "deny-by-default" authorization model; any permission granting access to resources owned by others must be validated against the resource owner's team membership, not merely its ownership class.
   • Review all roles and permissions quarterly to ensure least privilege, and audit any custom role definitions that inherit edit_other_timesheet or delete_other_timesheet.
   • Enforce robust authentication for team-lead accounts (MFA, conditional access), as these accounts now carry system-wide data access that cannot be restricted at the data layer.
   • Track the vendor's advisory channel and subscribe to release notes to identify when a patched version is available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-80202 (CVE-2026-80202, CVSS 8.8, CWE-863)
2. Kimai Official Website and Documentation: https://www.kimai.org (permission model and role definitions; maintainers state documented behavior)
3. CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html (weakness class reference)
4. CISA Known Exploited Vulnerabilities Catalog (no listing for CVE-2026-80202 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST.org EPSS (not yet scored for this CVE): https://www.first.org/epss/

Note: No threat actor campaigns, exploit-in-the-wild evidence, or third-party PoCs are currently known for this vulnerability. This CVE is not listed on the CISA KEV, and EPSS scoring has not yet been published.