Threats Tagged 'cve-2026-52820'
View all threats tagged with 'cve-2026-52820'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-52820'
Click on any threat for detailed analysis and mitigation recommendations
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass (CVE-2026-52820)CVE-2026-52820 0 Kimai versions prior to 2.57.0 have a vulnerability in the Timesheet API PATCH and POST endpoints that allows authenticated users to assign their timesheets to projects outside their authorized teams. This occurs because the project ID submitted by the user bypasses team membership checks due to an unconditional OR condition in the query builder. Consequently, users can access project and customer metadata that should be restricted by team access controls. Join the discussion | GCVE Database | 07/13/2026, 23:55:35 UTC Added: 07/14/2026, 09:21:12 UTC |
Showing 1 to 1 of 1 result