Incorrect authorization in kimai2 - CVE-2026-84806
Published: August 19, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU144295
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84806
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify team access control assignments.
The vulnerability exists due to improper authorization in team access-management endpoints when handling requests to assign customers, projects, or activities to teams. A remote user can send a specially crafted request to modify team access control assignments.
Exploitation requires edit permission on the team and view permission on the target customer, project, or activity.
Affected software
kimai2
How to mitigate CVE-2026-84806
Install security update from vendor's website.
kimai2 - update to 2.63.0