PT-2026-84681

CVE-2026-84808

Published

2026-09-02

Updated

2026-09-02

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.65.0

Description An authorization bypass exists in the REST API timesheet collection endpoint. The system fails to enforce activity-team access controls, allowing users with the view other timesheet permission to list timesheets associated with activities restricted to teams they are not members of, which bypasses intended data isolation.

Recommendations Update to version 2.65.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Rajib-Mahmud

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers