CVE-2026-80195
Received Received - Intake

Business Logic Flaw in Kimai Team Update API

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.63.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kimai before 2.63.0 has a business logic flaw in the team update API endpoint. When a user with team editing permissions sends a malformed members list to replace existing members, the system deletes all current members before validating the new list. This results in a validation error but leaves the team with no members or teamleaders, disrupting access control.

Detection Guidance

Detecting this vulnerability requires checking Kimai instances for version 2.63.0 or earlier. Inspect API logs for PATCH requests to /api/teams/{id} that return validation errors but still modify team membership. Look for teams with no members or teamleaders after such requests.

Impact Analysis

This vulnerability can disrupt team-based access control by removing all team members or teamleaders. It may lead to unauthorized access if improperly handled or cause service disruption by breaking team functionality.

Mitigation Strategies

Upgrade Kimai to version 2.63.0 or later immediately. Review team membership logs for unauthorized changes. Implement additional access controls to prevent unauthorized PATCH requests to team endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart