CVE-2026-84808

EUVD-2026-69920
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
kimaikimai
𝑥
< 2.65.0
CNA
Common Weakness Enumeration
References
https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw
https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-timesheet