CVE-2026-84808: Kimai before 2.65.0 Authorization Bypass via API Timesheet
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.65.0 - Compensating control
Restrict access to the Kimai REST API timesheet collection endpoint so that users with view_other_timesheet cannot list timesheets for activities restricted to teams they do not belong to.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the view_other_timesheet permission can exploit the affected REST API timesheet collection endpoint. The issue allows that user to list timesheets associated with activities restricted to teams they do not belong to.
What information could be exposed?
The impact is limited to unauthorized disclosure of timesheet data through the API collection endpoint. The provided data does not indicate modification or availability impact.
Which deployments are affected?
Kimai versions before 2.65.0 are affected. Exposure depends on having users with view_other_timesheet permission and activity-team restrictions intended to isolate timesheet visibility.
How can I determine whether this is relevant in my environment?
Check whether your Kimai version is earlier than 2.65.0, then identify users granted view_other_timesheet permission. Review whether those users can query the REST API timesheet collection and whether activities are restricted to teams the users do not belong to.