CVE-2026-52828: Kimai Package ExportTemplate CRUD Lacks Authorization Check for TEAMLEAD Role
Summary
CVE-2026-52828: Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access. Affects kimai/kimai versions < 2.58.0. Fixed in 2.58.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kimai is an open-source time-tracking software that allows users to manage their time and projects efficiently. It features various functionalities such as reporting, invoicing, and export capabilities. The software is designed to cater to different user roles, including administrators, team leads, and regular users, each with specific permissions. However, a recent vulnerability has been identified that compromises the intended permission structure, allowing lower-privileged users to perform actions meant for higher-privileged roles.
Vulnerability Detail
The vulnerability arises from the ExportController's web routes for creating and editing export templates, which are only protected by the class-level 'create_export' permission. This permission is granted to the ROLE_TEAMLEAD by default, allowing them to access template creation and editing routes directly. In contrast, the API routes and UI button visibility correctly enforce the stricter 'create_export_template' permission, which is reserved for ROLE_ADMIN and ROLE_SUPER_ADMIN. As a result, a TEAMLEAD can create or modify global export templates, impacting all users, including administrators, and potentially altering the data output format used across the application. This vulnerability violates the intended permission boundaries, leading to possible data integrity issues.
How To Fix
Minimum fixed version
2.58.0
This is the first release that contains the fix.
composer require kimai/kimai:2.58.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the ROLE_TEAMLEAD from accessing the ExportController routes until the package is updated. This can be achieved by modifying the permissions in the configuration file to prevent TEAMLEADs from having 'create_export' access.
Conclusion
The CVE-2026-52828 vulnerability in the Kimai package poses a risk by allowing TEAMLEAD users to create and modify global export templates without proper authorization. It is crucial to update the package to version 2.58.0 or later to mitigate this issue and ensure that permission boundaries are respected.
See every vulnerability recorded for kimai/kimai →
FAQ
CVE-2026-52828 is a vulnerability in the Kimai package that allows users with the TEAMLEAD role to create and modify global export templates without proper authorization.
The vulnerability allows lower-privileged users to influence the data output format used by all users, including administrators, potentially leading to data integrity issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, restrict the ROLE_TEAMLEAD from accessing the ExportController routes until the package is updated.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for kimai/kimai.
