CVE-2026-84808 MEDIUM

CVE-2026-84808: Kimai before 2.65.0 Authorization Bypass via API Timesheet

Vendor Kimai

Product kimai

Weakness CWE-863 · Incorrect authorization

Published September 2, 2026

Last update September 2, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

Key dates

02Disclosure timeline

September 2, 2026 CVE published

September 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-84808 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2025-3861 Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions CVE-2026-9048 Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 CVE-2025-14352 Awesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modification CVE-2025-7374 WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass