Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Kimai Time-Tracking: Insecure Access to Customer Invoices
CVE-2026-28685
GHSA-v33r-r6h2-8wr7
GHSA-v33r-r6h2-8wr7
Summary
A security issue in Kimai's time-tracking app allowed users with a specific role to view invoices from other customers. This could have led to unauthorized access to sensitive information. Update to version 2.51.0 or later to fix the issue.
What to do
- Update kimai kimai to version 2.51.0.
- Update kimai kimai/kimai to version 2.51.0.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| kimai | kimai | <= 2.50.0 | 2.51.0 |
| kimai | kimai/kimai | <= 2.51.0 | 2.51.0 |
| kimai | kimai | <= 2.51.0 | – |
Original title
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting us...
Original description
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
nvd CVSS3.1
6.5
Vulnerability type
CWE-285
Improper Authorization
CWE-862
Missing Authorization
- https://nvd.nist.gov/vuln/detail/CVE-2026-28685
- https://github.com/advisories/GHSA-v33r-r6h2-8wr7
- https://github.com/kimai/kimai/commit/a0601c8cb28fed1cca19051a8272425069ab758f
- https://github.com/kimai/kimai/releases/tag/2.51.0
- https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7
- https://github.com/kimai/kimai Product
Published: 6 Mar 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026