CVE-2026-84805: Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.63.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kimai deployments running versions from 2.61.0 up to, but not including, 2.63.0 are affected. Exploitation requires an authenticated low-privilege user account; unauthenticated attackers are not described as able to exploit it.
What access and endpoint are required for exploitation?
An attacker needs a regular authenticated Kimai account and uses PATCH /api/users/{id}/preferences to modify their own preferences. The affected fields are admin-only work-contract preferences that should require the contract_other_profile permission.
Are users who only use the web interface affected?
The web interface applies the required permission gate for these employment-contract fields. The bypass occurs through the API endpoint because the API registered the preferences as enabled without the same permission check.
What should teams do if they cannot upgrade immediately?
Restrict low-privilege users' ability to access the affected API endpoint, particularly PATCH /api/users/{id}/preferences, where feasible. Review work-contract preference changes made by regular users, since affected users can modify their own admin-only work-contract data.
How can administrators check whether their instance is affected?
Check whether the Kimai version is 2.61.0 or later but earlier than 2.63.0. On affected versions, verify whether a regular user can submit PATCH requests to /api/users/{id}/preferences for their own account and alter work-contract preferences without the contract_other_profile permission.