Missing Authorization in kimai2 - CVE-2026-84804
Published: August 19, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU144293
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84804
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to revoke a team\'s access to an activity, project, or customer without proper authorization.
The vulnerability exists due to missing authorization in the team access management API endpoints when handling delete requests for team assignments. A remote user can send a specially crafted delete request to revoke a team\'s access to an activity, project, or customer without proper authorization.
Exploitation requires an authenticated API user who can edit the target team but is not allowed to manage permissions for the target activity, project, or customer.
Affected software
kimai2
How to mitigate CVE-2026-84804
Install security update from vendor's website.
kimai2 - update to 2.65.0