Improper Authorization in Kimai Team Access Endpoints

CVE-2026-84806

What is CVE-2026-84806?

Kimai versions before 2.63.0 have an improper authorization vulnerability in team access endpoints. This flaw allows authenticated users with edit permissions to exploit insufficient checks by initiating unauthorized POST requests, potentially granting themselves access to modify permissions for customers, projects, or activities that should otherwise be restricted. It exposes sensitive access controls and poses significant risks to data integrity and privacy.

References