Authorization Bypass Vulnerability in Kimai by Kimai Development
CVE-2026-84808

5.3MEDIUM

Key Information:

Vendor

Kimai

Status
Kimai
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84808?

Kimai versions prior to 2.65.0 are susceptible to an authorization bypass vulnerability in the REST API's timesheet collection endpoint. This flaw allows users who possess the 'view_other_timesheet' permission to access and list timesheets associated with activities that are meant to be restricted to different teams. The lack of proper access control enforcement compromises the intended data isolation, potentially exposing sensitive information to unauthorized users.

Affected Version(s)

kimai 0 < 2.65.0

kimai 2.65.0

References

https://github.com/kimai/kimai/security/advisories/GHSA-c...
vendor-advisory
https://www.vulncheck.com/advisories/kimai-before-2.65.0-...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rajib-Mahmud
.