CVE-2026-84806 in Kimai
Summary
by MITRE • 09/02/2026
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Kimai versions prior to 2.63.0 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-862: Missing Authorization. This flaw resides within the application's team management subsystem, where the logic governing permission validation for team-related endpoints is insufficiently rigorous. The core technical issue stems from an improper check of user privileges when processing requests to modify access controls for associated entities such as customers, projects, or activities. While the system correctly restricts certain actions based on role-based permissions, it fails to verify whether a user with edit rights over a team possesses the necessary administrative authority to alter the access lists of linked resources that may fall outside their direct scope of responsibility.
From an operational perspective, this vulnerability allows authenticated users who hold team edit permissions and read-only access to other entities to escalate their effective privileges within those specific contexts. By sending crafted POST requests to the affected team access endpoints, an attacker can bypass intended restrictions and grant themselves or others access to sensitive data structures like customer records, project details, or activity logs that they should not be able to view or modify. This constitutes a classic case of Insecure Direct Object Reference combined with Broken Access Control, where the application trusts client-supplied input regarding entity ownership without adequately validating it against the user's actual permission set on the server side.
The impact of this vulnerability is significant for organizations relying on Kimai for time tracking and project management, as it compromises the confidentiality and integrity of business-critical data. Attackers can exploit this flaw to exfiltrate sensitive customer information, manipulate project timelines by altering activity access, or establish persistent backdoor access within specific team structures. This aligns with MITRE ATT&CK technique T1078: Valid Accounts, as it leverages legitimate credentials, and specifically relates to T1546.003: Event Triggered Execution if the modification leads to automated actions, though primarily it falls under privilege escalation via broken access control mechanisms found in T1098 or general unauthorized access patterns described in T1078.
To mitigate this vulnerability, organizations must immediately upgrade Kimai to version 2.63.0 or later, where these permission checks have been corrected to ensure that users can only modify access controls for entities they are explicitly authorized to manage. In the interim, administrators should enforce strict role-based access control policies, limiting team edit permissions to senior staff who require such broad authority. Additionally, implementing comprehensive logging and monitoring of POST requests to team-related endpoints can help detect anomalous behavior indicative of exploitation attempts. Regular security audits focusing on authorization logic in multi-tenant or team-based applications are essential to prevent similar flaws from persisting in future updates.