Medium severity4.3NVD Advisory· Published Sep 2, 2026· Updated Sep 2, 2026

CVE-2026-84808

Description

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kimai/Kimaillm-fuzzy
Range: <2.65.0

Patches

Vulnerability mechanics

References

github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hwnvd
www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-timesheetnvd

News mentions

Kimai: Five Authorization Bypass Vulnerabilities Disclosed Together
Vypr Intelligence · Sep 2, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000