CVE-2026-49992— Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Quick assessment
Affected
kimai kimai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kimai 是一款开源的时间追踪应用。在 2.58.0 之前的版本中，其默认的团队创建快捷方式（涉及项目、客户和活动）存在经过身份验证的跨站请求伪造（CSRF）漏洞。这些端点通过 路由暴露，会直接创建或复用一个 ，将当前用户添加为团队负责人（teamlead），并将目标对象绑定到该团队。因此，攻击者可以诱使拥有相应权限的登录用户访问一个恶意页面，从而导致对团队、团队负责人以及对象绑定关系进行非授权变更。这是一个真实的授权结构修改问题，而不仅仅是无害的 UI 快捷方式。该漏洞已在 2.58.0 版本中得到修复。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
Source: CVE Program / CVE List V5
Vulnerability Description
Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49992
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49992 (1)
IV. Related Vulnerabilities
Same product: kimai
-
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Renderi -
CVE-2026-84807
Kimai before 2.65.0 Authentication Bypass via Team Creation -
CVE-2026-84808
Kimai before 2.65.0 Authorization Bypass via API Timesheet -
CVE-2026-84806
Kimai before 2.63.0 Authorization Bypass via Team Access End -
CVE-2026-84804
Kimai before 2.65.0 Authorization Bypass via Team Activity A
Same vendor: kimai
-
CVE-2026-49865
Kimai has Server-Side Request Forgery in Invoice PDF Renderi -
CVE-2026-84807
Kimai before 2.65.0 Authentication Bypass via Team Creation -
CVE-2026-84808
Kimai before 2.65.0 Authorization Bypass via API Timesheet -
CVE-2026-84806
Kimai before 2.63.0 Authorization Bypass via Team Access End -
CVE-2026-84804
Kimai before 2.65.0 Authorization Bypass via Team Activity A
Same weakness: CWE-352
-
CVE-2026-81907
Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Req -
CVE-2026-68526
Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calen -
CVE-2026-81912
Concrete CMS before 9.5.3 is vulnerable to Cross-Site Reques -
CVE-2026-62139
WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site -
CVE-2026-62133
WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forger
V. Comments for CVE-2026-49992
No comments yet