CVE-2026-84804: Kimai before 2.65.0 Authorization Bypass via Team Activity API

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-04
Weakness: CWE-284

Description

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

Affected products

kimai: before 2.65.0 — fixed in 2.65.0

How to fix

Upgrade to a fixed version: kimai 2.65.0. Check the vendor advisory for mitigations.

References

https://github.com/kimai/kimai/security/advisories/GHSA-mc86-77vp-82g3
https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-team-activity-api

Get alerted when CVE-2026-84804 or the next vulnerability affects your stack