CVE-2026-49992: 
PHP vulnerability analysis and mitigation

CVE-2026-49992 is a Cross-Site Request Forgery (CSRF) vulnerability in Kimai, an open-source time-tracking application, affecting versions up to and including 2.57.0. The flaw exists in default team creation shortcut endpoints for projects, customers, and activities, which are exposed as GET routes but perform persistent authorization-structure writes. It was first published on June 3, 2026, and added to the GitHub Advisory Database on July 13, 2026. The vulnerability carries a CVSS v4 base score of 6.3 (Medium), though it is estimated as HIGH severity due to its impact on authorization topology (GitHub Advisory, Kimai Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the affected GET endpoints perform state-changing operations without verifying that the request was intentionally initiated by the authenticated user. The three vulnerable routes — GET /en/admin/project/{id}/create_team, GET /en/admin/customer/{id}/create_team, and GET /en/admin/activity/{id}/create_team — each create or reuse a Team object, assign the currently authenticated user as teamlead, and bind the target resource (project, customer, or activity) to that team. Because these are GET requests, they can be triggered by embedding a simple URL in an <img> tag, iframe, or hyperlink on a malicious page, requiring no complex payload. The prerequisite is that the victim must be logged into Kimai with sufficient permissions to manage the target object's team assignments (GitHub Advisory, Kimai Advisory).

Successful exploitation allows an attacker to remotely alter Kimai's permission topology without the victim's intentional action. A crafted attack can create or reuse a team, assign the victim user as its teamlead, and bind a project, customer, or activity to that team — all without the victim's knowledge. This can affect visibility rules, assignment scope, team-based access control, and reporting, and may enable later privilege-expansion chains by manipulating who has oversight of sensitive business objects (GitHub Advisory).

A proof-of-concept was reportedly provided to the maintainers but was removed from the advisory for security reasons. There is no public evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved" as of the report date. No EPSS score or CISA KEV catalog listing has been identified for this vulnerability. Exploitation requires social engineering a logged-in Kimai user with team management permissions into visiting a malicious page (GitHub Advisory, Kimai Advisory).

1. Reconnaissance: Identify a target Kimai instance running version ≤ 2.57.0 and identify a user account with permissions to manage team assignments for projects, customers, or activities.
2. Identify target resource IDs: Browse or enumerate the Kimai instance to obtain valid {id} values for projects, customers, or activities the target user can manage (e.g., via the Kimai API or UI).
3. Craft malicious payload: Create a web page containing one or more elements that silently trigger the vulnerable GET endpoints when loaded, for example:

   <img src="https://kimai.example.com/en/admin/project/42/create_team" style="display:none">
   <img src="https://kimai.example.com/en/admin/customer/7/create_team" style="display:none">

4. Deliver to victim: Send the malicious page URL to the target user via phishing email, chat message, or embedded link, while the user is authenticated to Kimai.
5. Trigger state change: When the victim's browser loads the page, it automatically sends authenticated GET requests to the vulnerable endpoints using the victim's session cookies, causing Kimai to create or reuse a team, assign the victim as teamlead, and bind the target object to that team.
6. Leverage modified permissions: The attacker (or a colluding account) can subsequently exploit the altered team/teamlead structure to gain expanded visibility or access to the bound project, customer, or activity (GitHub Advisory).

• Logs: Unexpected GET requests to /en/admin/project/{id}/create_team, /en/admin/customer/{id}/create_team, or /en/admin/activity/{id}/create_team in Kimai's web server access logs, especially originating from unusual referrer URLs or external domains.
• Application Behavior: Newly created teams or unexpected teamlead assignments appearing in Kimai's team management interface without corresponding intentional admin actions.
• Network: HTTP GET requests to the above endpoints with a Referer header pointing to an external or unknown domain, indicating the request was triggered from a third-party page rather than the Kimai UI.

Kimai has addressed this vulnerability in version 2.58.0 by moving the affected routes from GET to API POST endpoints, which are protected against CSRF by design. All users running Kimai ≤ 2.57.0 should upgrade to version 2.58.0 immediately. No configuration-based workaround is documented; upgrading is the only recommended remediation (GitHub Advisory, Kimai Advisory).