MEDIUM 5.3 NVD
CVE-2026-84808
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team acc
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
References
- https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw
- https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-time
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-09-02 via NVD.
vulnfeed aggregates 11639 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.