Kimai: Ten Vulnerabilities Including Critical Docker Flaw Disclosed Together
Ten vulnerabilities, including a critical Docker image flaw and an authentication bypass, were disclosed for the Kimai time tracking application on September 15, 2026.
Key findings
- Ten vulnerabilities disclosed for Kimai on September 15, 2026, with a critical Docker image flaw.
- Critical CVE-2026-52824 exposes a default APP_SECRET in the official Docker image.
- High severity CVE-2026-52827 allows API access with incomplete 2FA via session cookies.
- Multiple vulnerabilities stem from improper permission checks and access control issues.
- Fixes are available in Kimai versions 2.57.0, 2.58.0, and 2.59.0.
On September 15, 2026, a batch of ten vulnerabilities was disclosed for the Kimai open-source time tracking application, with a critical flaw in the Docker image posing the most significant risk. The vulnerabilities, disclosed on the same day, span various components and impact different versions of the software, with fixes available in versions 2.57.0, 2.58.0, and 2.59.0.
Several vulnerabilities revolve around improper permission checks and access control. CVE-2026-52828 and CVE-2026-52821 highlight issues where specific creation permissions are inherited without the necessary edit access for associated projects or customers. Similarly, CVE-2026-52820 points to an unconditional OR branch in the ProjectRepository that allows a user-controlled project identifier to bypass checks. CVE-2026-52823 and CVE-2026-52826 involve improper handling of rate identifiers and the ability to derive new timesheet records from historical data even after access to the original project or activity has been revoked.
Authentication and session management are also affected. CVE-2026-52827 describes a critical flaw where a session cookie issued after password verification but before Two-Factor Authentication (2FA) completion is accepted by API routes, potentially allowing unauthorized access. CVE-2026-52823 and CVE-2026-52823 also touch upon state-changing operations performed via GET requests without proper request-forgery defenses.
A particularly concerning vulnerability, CVE-2026-52824, is a critical issue within the official Docker image. The APP_SECRET is set to a public, default value (change_this_to_something_unique) in the Dockerfile, and the entrypoint script fails to replace or reject this value. This allows an unauthenticated attacker to exploit this predictable secret, potentially leading to full system compromise.
Further issues include CVE-2026-52825, where a team lead can add users to teams or activities without proper verification of the user's access or the activity's view access. CVE-2026-52819 involves the timesheet list endpoint accepting user identifiers without verifying that a team lead actually manages the target users.
The disclosed vulnerabilities have been addressed in Kimai versions 2.57.0, 2.58.0, and 2.59.0. Users are strongly advised to update to the latest available versions to mitigate these security risks. The batch of disclosures underscores the importance of regular security audits and timely patching for all software, especially open-source applications handling sensitive user data.
The timely patching of these vulnerabilities across multiple versions is crucial for maintaining the security and integrity of Kimai installations. Users should consult the official Kimai advisories for detailed information on affected versions and the specific fixes implemented in each release.
The critical nature of CVE-2026-52824, stemming from a default secret in the Docker image, highlights a common pitfall in containerized deployments and emphasizes the need for secure configuration practices from the outset.
This coordinated disclosure event provides a comprehensive overview of recent security weaknesses in Kimai, enabling administrators to proactively address potential threats and secure their time-tracking infrastructure.
The variety of vulnerabilities, from permission escalations to authentication bypasses and critical secret exposure, indicates a need for a thorough review of Kimai's security posture.
Staying updated with the latest releases and security advisories is paramount for all Kimai users to protect against potential exploitation.
The fixes for these issues are detailed in the respective version releases, and users should ensure they are running a patched version.
The disclosure of these ten CVEs on a single day signifies a focused effort to address a cluster of security concerns within the Kimai application.
The impact ranges from unauthorized data access to potential system compromise, making prompt patching essential.
Administrators should prioritize updating their Kimai instances to the latest secure versions to safeguard their data and operations.
The vulnerabilities affect various aspects of the application, including API endpoints, administrative interfaces, and core functionalities.
This batch of vulnerabilities serves as a reminder of the ongoing need for vigilance in cybersecurity for all software applications.