Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVE-2026-52828)
Kimai versions prior to 2.58.0 have a missing authorization check in the ExportController web routes for creating and editing export templates. This allows users with the ROLE_TEAMLEAD permission to create or modify global export templates, which should be restricted to administrators. These templates affect the structure and content of exported data visible to all users. The issue violates intended permission boundaries but does not lead to remote code execution or credential exposure.
AI Analysis
Technical Summary
The ExportController in Kimai applies a class-level permission check for 'create_export' granted to ROLE_TEAMLEAD, but lacks method-level checks for the stricter 'create_export_template' permission required for creating and editing export templates. While API routes and UI elements enforce the stricter permission for administrators, the web routes do not, enabling TEAMLEAD users to create or modify global export templates visible to all users. ExportTemplate entities are global without per-user or per-team scoping, allowing unauthorized modification of export data formats. The issue was fixed by adding the missing 'create_export_template' permission checks to the relevant controller methods.
Potential Impact
Users with the ROLE_TEAMLEAD permission can create and modify global export templates intended only for administrators. This allows lower-privileged users to influence the data output format used by all users, including administrators. The impact is limited to data integrity manipulation of export templates and does not include remote code execution, credential exposure, or other security-critical effects.
Mitigation Recommendations
A fix is available in Kimai version 2.58.0 and later, which adds the required 'create_export_template' permission checks to the ExportController methods for creating and editing export templates. Users should upgrade to version 2.58.0 or later to remediate this vulnerability.
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVE-2026-52828)
Description
Kimai versions prior to 2.58.0 have a missing authorization check in the ExportController web routes for creating and editing export templates. This allows users with the ROLE_TEAMLEAD permission to create or modify global export templates, which should be restricted to administrators. These templates affect the structure and content of exported data visible to all users. The issue violates intended permission boundaries but does not lead to remote code execution or credential exposure.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ExportController in Kimai applies a class-level permission check for 'create_export' granted to ROLE_TEAMLEAD, but lacks method-level checks for the stricter 'create_export_template' permission required for creating and editing export templates. While API routes and UI elements enforce the stricter permission for administrators, the web routes do not, enabling TEAMLEAD users to create or modify global export templates visible to all users. ExportTemplate entities are global without per-user or per-team scoping, allowing unauthorized modification of export data formats. The issue was fixed by adding the missing 'create_export_template' permission checks to the relevant controller methods.
Potential Impact
Users with the ROLE_TEAMLEAD permission can create and modify global export templates intended only for administrators. This allows lower-privileged users to influence the data output format used by all users, including administrators. The impact is limited to data integrity manipulation of export templates and does not include remote code execution, credential exposure, or other security-critical effects.
Mitigation Recommendations
A fix is available in Kimai version 2.58.0 and later, which adds the required 'create_export_template' permission checks to the ExportController methods for creating and editing export templates. Users should upgrade to version 2.58.0 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rw46-qg69-vg6h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52828"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a55ff7f68715ace432f3e08
Added to database: 07/14/2026, 09:21:03 UTC
Last enriched: 07/14/2026, 09:41:00 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.