CVE-2026-28685— Kimai: API invoice endpoint missing customer-level access control (IDOR)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kimai: API invoice endpoint missing customer-level access control (IDOR)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
kimai 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
kimai是kimai个人开发者的一个基于网络的多用户时间跟踪应用程序。 kimai 2.51.0之前版本存在授权问题漏洞，该漏洞源于仅检查基于角色的view_invoice权限但未验证请求用户对发票客户的访问权限，可能导致具有ROLE_TEAMLEAD角色的用户读取系统中所有发票。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-28685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28685
请登录查看更多情报信息。
- Release 2.51.0 · kimai/kimai · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-28685
IV. Related Vulnerabilities
Same product: kimai
- CVE-2026-44298
Kimai: Arbitrary file read in invoice PDF renderer (admin) - CVE-2026-41498
Kimai: Team API Missing Object-Level Authorization - CVE-2026-42267
Kimai: Formula Injection via tag names in XLSX export - CVE-2026-40486
Kimai's User Preferences API allows standard users to modify - CVE-2026-40479
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in
Same vendor: kimai
- CVE-2026-44298
Kimai: Arbitrary file read in invoice PDF renderer (admin) - CVE-2026-41498
Kimai: Team API Missing Object-Level Authorization - CVE-2026-42267
Kimai: Formula Injection via tag names in XLSX export - CVE-2026-40486
Kimai's User Preferences API allows standard users to modify - CVE-2026-40479
Kimai: Stored XSS via Incomplete HTML Attribute Escaping in
Same weakness: CWE-285
- CVE-2026-8241
Industrial Application Software IAS Canias ERP RMI iasGetSer - CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint all - CVE-2026-33823
Microsoft Team Events Portal Information Disclosure Vulnerab - CVE-2026-41572
Note Mark: Unauthenticated read of notes and assets in soft- - CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route k
V. Comments for CVE-2026-28685
No comments yet