Business Logic Vulnerability in Kimai Affects User Authorization

CVE-2026-84807

What is CVE-2026-84807?

Kimai, through its team creation endpoints, has a vulnerability that allows authenticated users with project permission-management privileges to exploit the system. This flaw enables users to create or utilize a customer, project, or activity that shares a name with an existing team. Due to the design of the API endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team), the system does not verify the user's authorization to manage the team, thereby granting unauthorized team-lead rights. This issue has been addressed in version 2.65.0.

References