Authentication Bypass in Kimai Versions Affecting User Permissions

CVE-2026-84805

What is CVE-2026-84805?

Versions of Kimai from 2.61.0 to 2.62.0 are susceptible to an authentication bypass vulnerability that allows low-privilege users to access admin-only work-contract preferences through the API. The PATCH /api/users/{id}/preferences endpoint does not enforce the appropriate permission check for the WorkContractPreferenceSubscriber. Although these fields are secured through the web interface, the lack of checks in the API allows unauthorized modification of this sensitive data. This vulnerability has been addressed in version 2.63.0 with the implementation of the necessary permission checks.

References