CVE-2026-28685

The record

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.

Affected packages

Related vulnerabilities

• GHSA-v33r-r6h2-8wr7 Kimai's API invoice endpoint missing customer-level access control (IDOR) Same vulnerability
• GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Also affects kimai/kimai
• CVE-2019-25317 Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to… Also affects kimai/kimai
• GHSA-jg2j-2w24-54cg Kimai has an Authenticated Server-Side Template Injection (SSTI) Also affects kimai/kimai
• CVE-2026-23626 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
• GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Also affects kimai/kimai
• CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal… Also affects kimai/kimai
• CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285