CVE-2026-84805: Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-02 · updated 2026-09-02
Weakness: CWE-862

Description

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.

Affected products

kimai: from 2.61.0 before 2.63.0 — fixed in 2.63.0

How to fix

Upgrade to a fixed version: kimai 2.63.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-84805 or the next vulnerability affects your stack