CVE-2026-52819

MEDIUM SEVERITY

Vulnerability Description

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Published Date

July 13, 2026

Last Modified

July 13, 2026

Source

GitHub

Vendor

composer

Product

kimai/kimai