CVE-2026-80197CWE-639

CVE-2026-80197

Medium · published August 26, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-26T09:18Z
References (2)
https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7 · [email protected]https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints · [email protected]
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 25 AUG 23:19Z
    Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
    cvelistv5