CVE-2026-84808
Received Received - Intake

Kimai REST API Authorization Bypass in Timesheet Collection

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84808
EUVD
EUVD-2026-69920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.65.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kimai versions before 2.65.0 have an authorization bypass in the REST API timesheet collection endpoint. Users with view_other_timesheet permission can list timesheets for activities restricted to teams they do not belong to, bypassing intended data isolation controls.

Detection Guidance

Check Kimai version with: curl -s https://your-kimai-instance.com/api/version | grep version. If version is below 2.65.0, the system is vulnerable. Test API endpoint access with: curl -H 'Authorization: Bearer YOUR_TOKEN' https://your-kimai-instance.com/api/timesheets. If it returns timesheets from restricted activities without 403 errors, the vulnerability is present.

Impact Analysis

If you use team-restricted activities in Kimai and have view_other_timesheet permission, an attacker could access timesheet data they should not be able to see. This could lead to unauthorized data exposure of sensitive time records.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive time records, potentially violating data protection requirements under GDPR or HIPAA if such records contain personal or health-related information.

Mitigation Strategies

Upgrade Kimai to version 2.65.0 or later immediately. If upgrading is not possible, restrict access to the /api/timesheets endpoint by IP or disable the view_other_timesheet permission for affected users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart