CVE-2026-84804 kimai CVE debrief

Who should care

Administrators and users of Kimai versions before 2.65.0 should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest version and monitoring for suspicious activity related to team access changes via API endpoints. Security teams should review access controls and ensure that only authorized users have the edit_team permission. Additionally, operators and platform administrators should verify that their Kimai deployments are not exposed to unauthorized access or modifications through API endpoints.

Technical summary

The authorization bypass vulnerability in Kimai before version 2.65.0 occurs because authenticated users with edit_team permission can revoke team access to activities, projects, and customers via API endpoints without needing the permissions_activity check. This bypasses intended authorization controls, potentially allowing users with edit_team permissions to make unauthorized changes to team access. The vulnerability has a CVSS score of 5.3, indicating medium severity.

Defensive priority

Authenticated users with edit_team permission can potentially revoke team access without required permissions, indicating a medium-severity authorization bypass vulnerability.

Recommended defensive actions

• Review and update Kimai to version 2.65.0 or later to address the authorization bypass vulnerability.
• Restrict edit_team permissions to only trusted users and closely monitor API usage for suspicious activity.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Verify that Kimai deployments are not exposed to unauthorized access or modifications through API endpoints.
• Conduct a thorough review of access controls to ensure that only authorized users have the edit_team permission.
• Monitor for suspicious activity related to team access changes via API endpoints.
• Perform regular security audits to identify and address potential vulnerabilities in Kimai deployments.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Kimai before version 2.65.0, where authenticated users with edit_team permission can bypass authorization controls when removing team access to activities, projects, and customers via API endpoints. Evidence is based on official CVE and NVD records, as well as advisories from the vendor and a security researcher.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.