CVE-2026-40486
Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate
In short
Kimai's API lets any logged-in user change their own billing rates (hourly_rate and internal_rate) even if they shouldn't have permission to do so. This allows employees to modify how much they're billed or paid, affecting invoices and timesheets.
Technical detail
The User Preferences API endpoint (PATCH /api/users/{id}/preferences) in Kimai 2.52.0 and below fails to validate the isEnabled() flag on preference objects before persisting user-submitted values. Authenticated users can bypass role-based access controls (hourly-rate permission) to directly modify their hourly_rate and internal_rate attributes, impacting billing integrity and financial reporting.
Summary generated and translated by AI from the official description.
Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies submitted preference values without checking the isEnabled() flag on preference objects. Although the hourly_rate and internal_rate fields are correctly marked as disabled for users lacking the hourly-rate role permission, the API ignores this restriction and saves the values directly. Any authenticated user can modify their own billing rates through this endpoint, resulting in unauthorized financial tampering affecting invoices and timesheet calculations. This issue has been fixed in version 2.53.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
kimai · kimaiWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →