CVE-2026-84804: Kimai before 2.65.0 Authorization Bypass via Team Activity API
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.65.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kimai user with the edit_team permission can exploit it. The user does not need the permissions_activity permission that should be required to remove a team's access.
What actions can an affected user perform?
They can revoke team access to activities, projects, and customers through the affected API endpoints. This can improperly change authorization and may disrupt access for the team.
Which deployments are affected?
Kimai versions before 2.65.0 are affected. The issue applies where users are granted edit_team permission and can access the relevant API endpoints.