{"id":"CVE-2026-80197","aliases":["GHSA-j5mc-p8qg-39j7"],"url":"https://o3.security/vulnerability/CVE-2026-80197","summary":"Kimai before 2.57.0 Improper Authorization via Favorite Endpoints","details":"### Summary\n\nKimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's `timesheet.id` can add that record to, or remove it from, the victim's `favorite/recent` bookmark list. This allows cross-user manipulation of per-user favorite state without administrative privileges.\n\n### Details\n\nThe issue affects the following routes:\n\n- `GET /en/favorite/timesheet/add/{id}`\n- `GET /en/favorite/timesheet/remove/{id}`\n\nBoth endpoints accept a user-controlled timesheet identifier and only require the caller to hold the generic `start_own_timesheet` permission. They do not verify that the referenced `Timesheet` object belongs to the currently authenticated user.\n\n- In `src/Controller/FavoriteController.php`, the controller methods accept a `Timesheet` object directly and forward it to the favorite service. \n- The root cause becomes more obvious in `src/Timesheet/FavoriteRecordService.php`. The bookmark owner is derived from `$timesheet->getUser()` instead of the current session user.\n- Because of this design, any authenticated user who can reference another user's timesheet ID can modify the victim's `favorite/recent` bookmark data.\n\n*A PoC was provided, but removed for security reasons.*\n\n### Impact\n\nThis vulnerability allows any authenticated low-privileged user to manipulate another user's favorite bookmark state across accounts. An attacker can inject arbitrary victim-owned timesheet entries into the victim's quick-entry workflow, remove existing favorites, and repeatedly disturb the victim's normal timesheet usage without needing administrative privileges.\n\nThe issue does not directly disclose sensitive data, but it is a real cross-user business-state tampering vulnerability with clear integrity impact. Because the add and remove endpoints can be combined, an attacker can reliably insert, remove, and reorder entries in another user's `favorite/recent` list.","published":"2026-08-25T23:19:03.788Z","modified":"2026-10-28T02:30:48.581091927Z","cvss":null,"epss":{"score":0.00208,"percentile":0.11167,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"kimai/kimai","fixedVersion":"2.57.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80197.json"},{"type":"ADVISORY","url":"https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80197"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/kimai-before-2.57.0-improper-authorization-via-favorite-endpoints"},{"type":"PACKAGE","url":"https://github.com/kimai/kimai"},{"type":"WEB","url":"https://www.kimai.org/en/security/ghsa-j5mc-p8qg-39j7"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:48.581091927Z"}}