CVE-2026-84807

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.65.0

Description An improper authorization issue exists in the default team creation endpoints. An authenticated user with project permission-management privileges can gain unauthorized team-lead administration rights over an existing team. This occurs when a user creates or uses a customer, project, or activity with a name that matches an existing team. The system reuses the existing team and assigns the current user as the team lead without verifying the necessary authorization. The affected API endpoints are 'POST /api/customers/{id}/team', 'POST /api/projects/{id}/team', and 'POST /api/activities/{id}/team'.

Recommendations Update Kimai to version 2.65.0.