CVE-2026-84805
Received Received - Intake

Privilege Escalation in Kimai via Work Contract Preferences

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84805
EUVD
EUVD-2026-69917

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kimai kimai From 2.61.0 (inc) to 2.63.0 (exc)
kimai kimai 2.63.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Kimai versions 2.61.0 to 2.62.0. It allows authenticated regular users to modify admin-only work-contract preferences via the API endpoint PATCH /api/users/{id}/preferences. The issue occurs because the WorkContractPreferenceSubscriber enables these preferences without checking user permissions, even though the web interface restricts access to users with the contract_other_profile admin permission.

Detection Guidance

Check Kimai versions between 2.61.0 and 2.62.0. Use API requests to test if low-privilege users can modify admin-only work-contract fields via PATCH /api/users/{id}/preferences. Verify if the WorkContractPreferenceSubscriber component is active without proper permission checks.

Impact Analysis

Low-privilege users could alter their own work-contract data, potentially leading to unauthorized changes in employment details. This could cause data integrity issues or administrative confusion, though the impact is limited to self-modification.

Compliance Impact

This vulnerability allows low-privilege users to modify admin-only work-contract data via the API, which could lead to unauthorized changes in employment records. Such unauthorized modifications may violate data integrity requirements under GDPR (Article 5) and HIPAA (Security Rule), as these regulations mandate strict controls over personal and health-related data accuracy and access.

Mitigation Strategies

Upgrade Kimai to version 2.63.0 or later to apply the necessary permission checks. If upgrading is not immediately possible, restrict API access for low-privilege users or disable the PATCH /api/users/{id}/preferences endpoint temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart