{"action":"Upgrade kimai/kimai to 2.51.0 or later.","affected":[{"fixed":"2.51.0","introduced":"0"}],"component":"kimai/kimai","cve_ids":["CVE-2026-28685"],"ecosystem":"Packagist","epss":0.00479,"exploited":false,"fixed_versions":["2.51.0"],"ghsa_id":"GHSA-v33r-r6h2-8wr7","id":"tcs_01M5KF8Q092CDKES2GDZ4PXKXC","modified_at":"2026-03-06T15:31:28.398898Z","published_at":"2026-03-04T20:43:17Z","references":["https://osv.dev/vulnerability/GHSA-v33r-r6h2-8wr7","https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7","https://nvd.nist.gov/vuln/detail/CVE-2026-28685","https://github.com/kimai/kimai/commit/a0601c8cb28fed1cca19051a8272425069ab758f","https://github.com/kimai/kimai","https://github.com/kimai/kimai/releases/tag/2.51.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-v33r-r6h2-8wr7","url":"https://osv.dev/vulnerability/GHSA-v33r-r6h2-8wr7"}],"summary":"Kimai's API invoice endpoint missing customer-level access control (IDOR)"}