CVE-2026-80193

EUVD-2026-66215
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 28.27%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
kimaikimai
𝑥
< 2.62.0
CNA
Common Weakness Enumeration
References
https://github.com/kimai/kimai/security/advisories/GHSA-2w7f-x78f-89q2
https://www.vulncheck.com/advisories/kimai-before-2.62.0-authorization-bypass-via-quickentry