GHSA-v33r-r6h2-8wr7
Medium · 6.5CVSS
6.5
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
Kimai's API invoice endpoint missing customer-level access control (IDOR)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | kimai/kimai | 0 | 2.51.0 |
Related vulnerabilities
- CVE-2026-28685 Kimai is a web-based multi-user time-tracking application. Same vulnerability
- GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Also affects kimai/kimai
- CVE-2019-25317 Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to… Also affects kimai/kimai
- GHSA-jg2j-2w24-54cg Kimai has an Authenticated Server-Side Template Injection (SSTI) Also affects kimai/kimai
- CVE-2026-23626 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Also affects kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal… Also affects kimai/kimai
- CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285