Kimai’s User Preferences API endpoint PATCH /api/users/{id}/preferences does not honor the isEnabled flag on certain preference objects. Because the hourly_rate and internal_rate preferences are correctly marked as disabled for users lacking the hourly‑rate role, the API nevertheless accepts and stores values sent for these fields. Any authenticated user can therefore alter their own billing rates, which are subsequently used in invoice generation and timesheet calculations. The vulnerability is a classic instance of a permission enforcement bypass, classified as CWE‑915.

Versions of Kimai up to and including 2.52.0 are affected. The issue was resolved in version 2.53.0, which implements proper permission checks for these preferences.

The CVSS score of 4.3 places this vulnerability in the low‑to‑medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires authentication and access to the API, so an attacker must be a legitimate user of the application. While the impact is confined to the affected user’s own invoices and payroll calculations, it can cause significant financial inaccuracies if abused.