CVE-2026-84807
Received Received - Intake

Improper Authorization in Kimai Leading to Unauthorized Team Lead Access

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84807
EUVD
EUVD-2026-69919

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kimai kimai to 2.65.0 (inc)
kimai kimai to 2.65.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a business logic flaw in Kimai versions up to 2.65.0. An authenticated user with project permission-management rights can exploit endpoints like POST /api/customers/{id}/team to create or reuse a team by matching its name to an existing one. The system then adds the user as team lead without checking if they are authorized to manage that team, granting unauthorized administrative access.

Detection Guidance

Check for unauthorized team creation or modification by reviewing API logs for POST requests to /api/customers/{id}/team, /api/projects/{id}/team, or /api/activities/{id}/team. Look for instances where a team name matches an existing customer, project, or activity name. Verify if users without proper authorization were assigned team lead roles.

Impact Analysis

An attacker could gain unauthorized administrative rights over existing teams, allowing them to modify team settings, access sensitive data, or perform actions they shouldn't be permitted to do. This could lead to data breaches or unauthorized changes within the Kimai application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized administrative access may result in data leaks or improper handling of regulated information.

Mitigation Strategies

Upgrade Kimai to version 2.65.0 or later to apply the official patch. Review and revoke any unauthorized team lead assignments created through the vulnerable endpoints. Monitor for suspicious activity related to team creation or privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart