CVE-2026-84807: Kimai before 2.65.0 Authentication Bypass via Team Creation
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kimai/kimaito a version that resolves this vulnerability.Fixed in 2.65.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated and have project permission-management privileges. They can then use the affected team-creation endpoints to obtain team-lead rights over an existing team with a matching name.
Which interfaces are affected?
The affected default endpoints are POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team. The issue occurs when these endpoints reuse an existing team based on its name without checking authorization to manage that team.
Are default configurations affected?
Yes. The vulnerability is described in the default team creation endpoints, so deployments exposing and using these standard API endpoints are affected when running versions before 2.65.0.
How can I determine whether unauthorized elevation may have occurred?
Review use of the affected team-creation endpoints and inspect team-lead assignments for users who should not be authorized to administer the corresponding teams. Pay particular attention to teams whose names match customers, projects, or activities created or used by users with project permission-management privileges.
What is the available remediation?
Upgrade Kimai to version 2.65.0, which fixes the issue. The provided data does not identify an alternative mitigation for systems that cannot be patched immediately.