CVE-2026-84805

Name of the Vulnerable Software and Affected Versions Kimai versions 2.61.0 through 2.62.x

Description Low-privilege users can modify their own admin-only work-contract data because the system fails to enforce permission checks for certain preferences. While the web interface restricts these fields using the contract other profile admin permission, the WorkContractPreferenceSubscriber registers these preferences as enabled without verification. This allows an authenticated regular user to bypass restrictions via the PATCH '/api/users/{id}/preferences' endpoint.

Recommendations Update Kimai to version 2.63.0. Restrict access to the PATCH '/api/users/{id}/preferences' endpoint for low-privilege users to prevent unauthorized modification of work-contract data.