Packagist/kimai/kimai CVE-2026-52825: medium 5.3, EPSS 0.45%

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

Action: Upgrade kimai/kimai to 2.58.0 or later.

composer require kimai/kimai:2.58.0

Affected

Fixed versions

Sources

• osv: GHSA-xv4r-4885-gwpg
• nvd: CVE-2026-52825
• https://github.com/kimai/kimai/security/advisories/GHSA-xv4r-4885-gwpg
• https://github.com/kimai/kimai

CVE-2026-52825 · published 2026-07-14T00:09:03Z · modified 2026-07-14T00:26:47.365589Z · JSON