{"id":"CVE-2026-49992","title":"Kimai is an open-source time tracking application","summary":"Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exp…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-352"],"vendor":"kimai","product":"kimai","affected":["kimai < 2.58.0"],"patched":["kimai/kimai 2.58.0"],"published":"2026-09-11","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:22:16.503","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49992","references":[{"url":"https://github.com/kimai/kimai/security/advisories/GHSA-pgcc-vfmc-7cw5","label":"security-advisories@github.com"},{"url":"https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-pgcc-vfmc-7cw5"}],"tags":["nvd","cve.org","ghsa","composer"],"epss":0.00157,"epssPercentile":0.05235,"aliases":["GHSA-pgcc-vfmc-7cw5"],"ecosystem":"composer","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T16:14:41.401741Z"},"cvssSource":"cna","ingestedAt":"2026-07-14T00:31:48.598Z","slug":"CVE-2026-49992","body":"## Overview\n\nKimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49992)\n\nAffected packages:\n\n- `kimai/kimai <= 2.57.0`\n\nPatched in:\n\n- `kimai/kimai 2.58.0`\n\nSource: https://github.com/advisories/GHSA-pgcc-vfmc-7cw5","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201732,"id":"CVE-2026-49992","ts":1789399643097,"field":"cvss","old":null,"new":"6.3"},{"seq":200462,"id":"CVE-2026-49992","ts":1789397270645,"field":"cvss","old":"6.3","new":null},{"seq":198068,"id":"CVE-2026-49992","ts":1789384333620,"field":"cvss","old":null,"new":"6.3"},{"seq":196177,"id":"CVE-2026-49992","ts":1789383522754,"field":"cvss","old":"6.3","new":null},{"seq":195106,"id":"CVE-2026-49992","ts":1789380409156,"field":"cvss","old":null,"new":"6.3"},{"seq":193893,"id":"CVE-2026-49992","ts":1789378390054,"field":"cvss","old":"6.3","new":null},{"seq":192680,"id":"CVE-2026-49992","ts":1789376353798,"field":"cvss","old":null,"new":"6.3"},{"seq":191467,"id":"CVE-2026-49992","ts":1789373290840,"field":"cvss","old":"6.3","new":null},{"seq":190252,"id":"CVE-2026-49992","ts":1789369244890,"field":"cvss","old":null,"new":"6.3"},{"seq":189039,"id":"CVE-2026-49992","ts":1789368170841,"field":"cvss","old":"6.3","new":null},{"seq":187822,"id":"CVE-2026-49992","ts":1789365098542,"field":"cvss","old":null,"new":"6.3"},{"seq":186609,"id":"CVE-2026-49992","ts":1789363155465,"field":"cvss","old":"6.3","new":null},{"seq":185395,"id":"CVE-2026-49992","ts":1789361052847,"field":"cvss","old":null,"new":"6.3"},{"seq":184182,"id":"CVE-2026-49992","ts":1789358056954,"field":"cvss","old":"6.3","new":null},{"seq":182433,"id":"CVE-2026-49992","ts":1789354180461,"field":"cvss","old":null,"new":"6.3"},{"seq":181226,"id":"CVE-2026-49992","ts":1789353038916,"field":"cvss","old":"6.3","new":null},{"seq":180019,"id":"CVE-2026-49992","ts":1789350118864,"field":"cvss","old":null,"new":"6.3"},{"seq":178812,"id":"CVE-2026-49992","ts":1789347993897,"field":"cvss","old":"6.3","new":null},{"seq":177605,"id":"CVE-2026-49992","ts":1789346240836,"field":"cvss","old":null,"new":"6.3"},{"seq":176398,"id":"CVE-2026-49992","ts":1789342908151,"field":"cvss","old":"6.3","new":null},{"seq":175852,"id":"CVE-2026-49992","ts":1789338693156,"field":"cvss","old":null,"new":"6.3"},{"seq":175722,"id":"CVE-2026-49992","ts":1789338512309,"field":"cvss","old":"6.3","new":null},{"seq":174517,"id":"CVE-2026-49992","ts":1789334716086,"field":"cvss","old":null,"new":"6.3"},{"seq":173312,"id":"CVE-2026-49992","ts":1789333399308,"field":"cvss","old":"6.3","new":null},{"seq":172126,"id":"CVE-2026-49992","ts":1789330959756,"field":"cvss","old":null,"new":"6.3"},{"seq":170940,"id":"CVE-2026-49992","ts":1789328508535,"field":"cvss","old":"6.3","new":null},{"seq":169735,"id":"CVE-2026-49992","ts":1789327007310,"field":"cvss","old":null,"new":"6.3"},{"seq":168530,"id":"CVE-2026-49992","ts":1789323562201,"field":"cvss","old":"6.3","new":null},{"seq":167325,"id":"CVE-2026-49992","ts":1789319452580,"field":"cvss","old":null,"new":"6.3"},{"seq":166120,"id":"CVE-2026-49992","ts":1789318455195,"field":"cvss","old":"6.3","new":null},{"seq":164915,"id":"CVE-2026-49992","ts":1789315646704,"field":"cvss","old":null,"new":"6.3"},{"seq":163710,"id":"CVE-2026-49992","ts":1789313372089,"field":"cvss","old":"6.3","new":null},{"seq":162505,"id":"CVE-2026-49992","ts":1789311767812,"field":"cvss","old":null,"new":"6.3"},{"seq":161300,"id":"CVE-2026-49992","ts":1789308413007,"field":"cvss","old":"6.3","new":null},{"seq":160805,"id":"CVE-2026-49992","ts":1789304354926,"field":"cvss","old":null,"new":"6.3"},{"seq":160352,"id":"CVE-2026-49992","ts":1789303906163,"field":"cvss","old":"6.3","new":null},{"seq":159413,"id":"CVE-2026-49992","ts":1789300356594,"field":"cvss","old":null,"new":"6.3"},{"seq":158643,"id":"CVE-2026-49992","ts":1789299405825,"field":"cvss","old":"6.3","new":null},{"seq":157607,"id":"CVE-2026-49992","ts":1789296543173,"field":"cvss","old":null,"new":"6.3"},{"seq":156402,"id":"CVE-2026-49992","ts":1789294491989,"field":"cvss","old":"6.3","new":null},{"seq":155197,"id":"CVE-2026-49992","ts":1789292744283,"field":"cvss","old":null,"new":"6.3"},{"seq":153992,"id":"CVE-2026-49992","ts":1789289470887,"field":"cvss","old":"6.3","new":null},{"seq":152642,"id":"CVE-2026-49992","ts":1789281407319,"field":"cvss","old":null,"new":"6.3"},{"seq":152282,"id":"CVE-2026-49992","ts":1789281009068,"field":"cvss","old":"6.3","new":null},{"seq":151243,"id":"CVE-2026-49992","ts":1789277500745,"field":"cvss","old":null,"new":"6.3"},{"seq":150204,"id":"CVE-2026-49992","ts":1789275992354,"field":"cvss","old":"6.3","new":null},{"seq":149171,"id":"CVE-2026-49992","ts":1789273664693,"field":"cvss","old":null,"new":"6.3"},{"seq":148138,"id":"CVE-2026-49992","ts":1789271016542,"field":"cvss","old":"6.3","new":null},{"seq":147031,"id":"CVE-2026-49992","ts":1789269864272,"field":"cvss","old":null,"new":"6.3"},{"seq":145080,"id":"CVE-2026-49992","ts":1789266222607,"field":"cvss","old":"6.3","new":null}]}