SB2026081945 - Multiple vulnerabilities in kimai2

Description

This security bulletin contains information about 3 vulnerabilities.

1) Incorrect authorization (CVE-ID: CVE-2026-84807)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper authorization in the default team creation API endpoints when creating or reusing a project, customer, or activity team whose name matches an existing team. A remote user can create or use a project whose name matches an existing team to escalate privileges.

Exploitation requires project permission-management privileges, and the issue occurs because an existing team is reused and the current user is added as a teamlead without authorization checks.

2) Incorrect authorization (CVE-ID: CVE-2026-84808)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /api/timesheets endpoint when listing timesheet records via the REST API. A remote user can send a request to list timesheets belonging to other users to disclose sensitive information.

Exploitation requires the view_other_timesheet permission and installations that use team-restricted activities.

3) Missing Authorization (CVE-ID: CVE-2026-84804)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to revoke a team's access to an activity, project, or customer without proper authorization.

The vulnerability exists due to missing authorization in the team access management API endpoints when handling delete requests for team assignments. A remote user can send a specially crafted delete request to revoke a team's access to an activity, project, or customer without proper authorization.

Exploitation requires an authenticated API user who can edit the target team but is not allowed to manage permissions for the target activity, project, or customer.

Remediation

Install update from vendor's website.

References

• https://github.com/kimai/kimai/security/advisories/GHSA-hvq2-5gh2-rgvv
• https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw
• https://github.com/kimai/kimai/security/advisories/GHSA-mc86-77vp-82g3