What’s Vulnerable › Vulnerabilities

CVE-2026-84806: Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-02
• Weakness: CWE-732

Description

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

Affected products

• kimai: before 2.63.0 — fixed in 2.63.0

How to fix

Upgrade to a fixed version: kimai 2.63.0. Check the vendor advisory for mitigations.

References

• https://github.com/kimai/kimai/security/advisories/GHSA-gmm9-hfxg-7v29
• https://www.vulncheck.com/advisories/kimai-before-2.63.0-authorization-bypass-via-team-access-endpoints

Get alerted when CVE-2026-84806 or the next vulnerability affects your stack