Kimai Security Advisories https://www.kimai.org/ Wed, 06 May 2026 18:26:29 +0200 Wed, 06 May 2026 18:26:29 +0200 en Security advisories for Kimai Time-Tracker Kimai Logo /images/apple-touch-icon.png Kimai https://www.kimai.org/ 184 184 Authenticated SSTI to RCE by uploading a malicious twig file https://www.kimai.org/en/security/ghsa-fjhg-96cp-6fcw Fri, 27 Oct 2023 18:27:17 +0200 https://www.kimai.org/en/security/ghsa-fjhg-96cp-6fcw Read the full advisory here ]]> API returns timesheet entries a user shouldn't be authorized to view https://www.kimai.org/en/security/ghsa-cj3c-5xpm-cx94 Wed, 27 Mar 2024 22:58:18 +0100 https://www.kimai.org/en/security/ghsa-cj3c-5xpm-cx94 Read the full advisory here ]]> XXE leading to local file read https://www.kimai.org/en/security/ghsa-534c-hcr7-67jg Tue, 17 Sep 2024 08:18:39 +0200 https://www.kimai.org/en/security/ghsa-534c-hcr7-67jg Read the full advisory here ]]> Authenticated server-side template injection (SSTI) https://www.kimai.org/en/security/ghsa-jg2j-2w24-54cg Sun, 18 Jan 2026 17:06:10 +0100 https://www.kimai.org/en/security/ghsa-jg2j-2w24-54cg Read the full advisory here ]]> API invoice endpoint missing customer-level access control (IDOR) https://www.kimai.org/en/security/ghsa-v33r-r6h2-8wr7 Wed, 04 Mar 2026 13:43:17 +0100 https://www.kimai.org/en/security/ghsa-v33r-r6h2-8wr7 Read the full advisory here ]]> Open-redirect via unvalidated RelayState in SAML ACS handler https://www.kimai.org/en/security/ghsa-3jp4-mhh4-gcgr Sat, 11 Apr 2026 23:22:05 +0200 https://www.kimai.org/en/security/ghsa-3jp4-mhh4-gcgr Read the full advisory here ]]> API password hash leakage via invoice Twig template https://www.kimai.org/en/security/ghsa-rh42-6rj2-xwmc Sat, 11 Apr 2026 23:49:17 +0200 https://www.kimai.org/en/security/ghsa-rh42-6rj2-xwmc Read the full advisory here ]]> Stored XSS via incomplete HTML attribute escaping in Team-Member widget https://www.kimai.org/en/security/ghsa-g82g-m9vx-vhjg Tue, 14 Apr 2026 16:03:14 +0200 https://www.kimai.org/en/security/ghsa-g82g-m9vx-vhjg Read the full advisory here ]]> User Preferences API allows standard users to modify: hourly_rate, internal_rate https://www.kimai.org/en/security/ghsa-qh43-xrjm-4ggp Tue, 14 Apr 2026 16:05:11 +0200 https://www.kimai.org/en/security/ghsa-qh43-xrjm-4ggp Read the full advisory here ]]> Username enumeration via timing, using deprecated API authentication https://www.kimai.org/en/security/ghsa-jrc6-fmhw-fpq2 Thu, 16 Apr 2026 23:19:11 +0200 https://www.kimai.org/en/security/ghsa-jrc6-fmhw-fpq2 Read the full advisory here ]]>