Medium severity · published Aug 25, 2026
CVE-2026-80197
Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kimai · kimai
before 2.57.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80197
vendor-advisory
https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7
third-party-advisory
https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints
More from kimai
9.6
CVE-2020-19825
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges
9.1
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
8.8
CVE-2026-80202
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
8.8
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry
8.8
CVE-2023-53957
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking