A vulnerability described as critical has been identified in Kimai up to 2.50.x. The impacted element is an unknown function of the file /api/invoices/. Executing a manipulation can lead to improper authorization.
This vulnerability is tracked as CVE-2026-28685. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
