Logo
Retour à la veille

CVE-2026-52828

Publié : 15 septembre 2026
Modifié : 15 septembre 2026
Lien officiel NVD

Description détaillée

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.

Références et Patchs

https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601https://github.com/kimai/kimai/pull/5952https://github.com/kimai/kimai/releases/tag/2.58.0https://github.com/kimai/kimai/security/advisories/GHSA-rw46-qg69-vg6hhttps://www.kimai.org/en/security/ghsa-rw46-qg69-vg6h

Dernières Vulnérabilités

CVE-2026-92079

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS

CVE-2026-92078

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS

CVE-2026-92077

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS