CVE-2026-84806
Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 2, 2026
- Updated
- Sep 2, 2026
- Reserved
- Sep 2, 2026
Description
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-732 Incorrect Permission Assignment for Critical Resource
Affected Products
| Product | Versions |
|---|---|
kimaikimai |
|
References
- GitHub Security Advisory (GHSA-gmm9-hfxg-7v29)vendor-advisory
- VulnCheck Advisory: Kimai before 2.63.0 Authorization Bypass via Team Access Endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.