4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40486

CVE-2026-40486: Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

Kimai is an open-source time tracking application. In versions 2.52.0 and below, the User Preferences API endpoint (PATCH /api/users/{id}/preferences) applies submitted preference values without checking the isEnabled() flag on preference objects. Although the hourly_rate and internal_rate fields are correctly marked as disabled for users lacking the hourly-rate role permission, the API ignores this restriction and saves the values directly. Any authenticated user can modify their own billing rates through this endpoint, resulting in unauthorized financial tampering affecting invoices and timesheet calculations. This issue has been fixed in version 2.53.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40486

CVE-2026-40486:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kimai/kimai	composer	<= 2.52.0	2.53.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a Broken Object Property Level Authorization (BOPA) in Kimai's User Preferences API. The analysis of the provided information, including the vulnerability description and the commit history between the vulnerable version (<= 2.52.0) and the patched version (2.53.0), points directly to the updateUserPreference function within src/API/UserController.php.

The patch for this vulnerability introduces a crucial security check. Before the fix, the code would iterate through user-submitted preferences and apply them without verifying if the user had the necessary permissions. The added code if (!$meta->isEnabled()) { throw $this->createAccessDeniedException(...) } rectifies this by checking an isEnabled flag on the preference object. This flag is set based on the user's roles, and the new check prevents unauthorized modifications to sensitive fields like hourly_rate and internal_rate. The exploitation of this vulnerability would involve a call to the updateUserPreference function, making it the primary runtime indicator for this CVE.

Vulnerable functions

App\API\UserController::updateUserPreference

src/API/UserController.php

The vulnerability lies in the `updateUserPreference` function, which, prior to the patch, did not validate whether a user was authorized to modify certain preferences. Specifically, it failed to check the `isEnabled` status of a preference before setting its value. This allowed any authenticated user to send a PATCH request to the `/api/users/{id}/preferences` endpoint and modify restricted attributes like `hourly_rate` and `internal_rate` for their own user profile, leading to a privilege escalation and business logic flaw.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.