CVE-2026-84807 kimai CVE debrief

Who should care

Defenders responsible for managing Kimai installations, particularly those with project permission-management privileges, should assess exposure and apply the vendor-provided patch to prevent potential unauthorized access to team management functionality.

Why it matters

CVE-2026-84807 is a business logic / improper authorization vulnerability in Kimai before version 2.65.0 that allows authenticated users to gain unauthorized team-lead rights. Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential unauthorized access to team management functionality.

• Potential unauthorized access to team management functionality.
• Elevation of privileges for authenticated users with project permission-management privileges.
• Possible disruption of team management and project coordination.
• Need for verification of current version and application of the vendor-provided patch.

Technical summary

The vulnerability exists in the default team creation endpoints of Kimai, specifically in the POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team, potentially gaining unauthorized team-lead rights over the existing team.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided patch to prevent potential unauthorized access to team management functionality.

Recommended defensive actions

• Verify if the current version of Kimai is vulnerable and prioritize patching to version 2.65.0 or later.
• Restrict project permission-management privileges to minimize the attack surface.
• Monitor team management functionality for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Vendor-provided advisories offer additional context on the issue and the available fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.