Kimai: Five Authorization Bypass Vulnerabilities Disclosed Together
Key findings • Five medium-severity authorization vulnerabilities disclosed together for Kimai time-tracking software. • Issues include bypasses in REST API timesheet collection and user pref…
Key findings
- Five medium-severity authorization vulnerabilities disclosed together for Kimai time-tracking software.
- Issues include bypasses in REST API timesheet collection and user preferences endpoints.
- Improper authorization found in team creation and access control for customers, projects, and activities.
- Vulnerabilities affect Kimai versions prior to 2.65.0 and 2.63.0.
- Patches are available in Kimai versions 2.65.0 and 2.63.0.
On September 2, 2026, a batch of five medium-severity vulnerabilities was disclosed for the Kimai time-tracking software. These vulnerabilities, all patched in various versions leading up to 2.65.0, primarily revolve around authorization bypass and improper permission checks within the application's API and team management functionalities. The disclosures highlight potential weaknesses in how Kimai enforces access controls, particularly concerning team-based data visibility and administrative privileges.
Several of the vulnerabilities stem from insufficient authorization checks in API endpoints. CVE-2026-84808, for instance, allows users with view_other_timesheet permission to list timesheets for activities restricted to teams they do not belong to, bypassing intended data segregation. Similarly, CVE-2026-84804 indicates that low-privilege users could modify admin-only work-contract preferences via the PATCH /api/users/{id}/preferences endpoint, despite the web interface correctly restricting these fields.
Further issues were found in team management and access control mechanisms. CVE-2026-84807 describes a business logic vulnerability where authenticated users with project permission-management privileges could create or manipulate entities (customers, projects, activities) to match existing team names, potentially leading to unintended access or data exposure. CVE-2026-84806 and CVE-2026-84804 both involve improper authorization in team access endpoints. The former allows authenticated users with team edit permissions to grant team access to customers, projects, or activities without sufficient checks, while the latter permits users with edit_team permission to revoke team access without the required permissions_activity validation.
The affected versions span a range of Kimai releases prior to 2.65.0. Specifically, CVE-2026-84808, CVE-2026-84807, and CVE-2026-84804 are addressed in version 2.65.0. CVE-2026-84806 and CVE-2026-84805 are fixed in version 2.63.0. Users are advised to update to the latest available version to mitigate these security risks.
This coordinated disclosure of five medium-severity vulnerabilities underscores the importance of regularly updating Kimai instances. The focus on authorization bypass and permission validation issues suggests that administrators should pay close attention to user roles and API access controls. Staying current with Kimai updates is crucial for maintaining the integrity of time-tracking data and preventing unauthorized access or manipulation.