CVE-2026-80193
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.
- Affected products
- Kimai
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.4% (29th percentile)
- Weakness
- CWE-862
- NVD status
- Deferred
- Published
- 2026-08-25
CVE-2026-80193 at NVD
1 known exploit for CVE-2026-80193
Proof-of-concept code and exploit modules indexed by Sploitus