CVE-2026-84806

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.63.0

Description An improper authorization issue exists in team access endpoints. Authenticated users possessing team edit permissions but only read-only access can grant team access to customers, projects, or activities. This occurs due to insufficient permission checks when sending POST requests to team access endpoints, allowing the modification of access control lists for entities the user should not be authorized to change.

Recommendations Update to version 2.63.0 or later.