Medium severity5.4NVD Advisory· Published Sep 2, 2026· Updated Sep 2, 2026

CVE-2026-84804

Description

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

Affected products

Kimai/Kimaillm-fuzzy
Range: <2.65.0

Patches

Vulnerability mechanics

References

github.com/kimai/kimai/security/advisories/GHSA-mc86-77vp-82g3nvd
www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-team-activity-apinvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000