CVE-2026-80195: Kimai Team Management Authorization Bypass

CVE-2026-80195 Overview

CVE-2026-80195 is a business logic and improper authorization vulnerability in Kimai, an open-source time-tracking application. The flaw affects the team update API endpoint PATCH /api/teams/{id} in versions prior to 2.63.0. The endpoint deletes all existing team membership rows before validating the submitted replacement member list. An authenticated user with permission to edit a team can trigger the deletion by sending a malformed members payload. Kimai returns a validation error, but the original memberships are already gone. This behavior bypasses the protections enforced by the dedicated member-removal endpoint and can leave a team without any members or teamleaders.

Critical Impact
An authenticated teamlead can wipe all members and teamleaders from a Kimai team through a single malformed API request, disrupting team-based access control.

Affected Products

Kimai versions prior to 2.63.0
Kimai team management API (PATCH /api/teams/{id})
Deployments exposing the Kimai REST API to authenticated users with team-edit permissions

Discovery Timeline

2026-08-26 - CVE CVE-2026-80195 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80195

Vulnerability Analysis

The vulnerability is a business logic flaw classified under CWE-841: Improper Enforcement of Behavioral Workflow. The team update handler performs destructive state changes before input validation completes. When an authenticated teamlead submits a PATCH request to /api/teams/{id}, the handler first removes every existing membership row associated with the target team. Only after that deletion does it attempt to validate and persist the new membership list supplied by the caller.

If the submitted members payload is malformed, validation fails and the transaction returns an error to the client. The membership deletion is not rolled back. The team is left in an inconsistent state with zero members and zero teamleaders. Because Kimai enforces team-based access control on projects, activities, and customers, wiping a team's membership disrupts authorization for every resource scoped to that team.

Root Cause

The root cause is an ordering defect in the team update workflow. Destructive membership changes are committed before payload validation is applied. The dedicated member-removal endpoint enforces a rule that prevents removing the last teamleader, but the team update endpoint does not consult that rule. The PATCH path therefore bypasses the workflow constraint that the removal endpoint was designed to guarantee.

Attack Vector

Exploitation requires an authenticated account with permission to edit a team, typically a teamlead. The attacker issues a PATCH /api/teams/{id} request over the network with a members field crafted to fail server-side validation, such as referencing invalid user identifiers or violating schema constraints. The server deletes the existing membership rows, then rejects the malformed payload. The team remains empty. No user interaction is required and no additional privileges are needed beyond team-edit rights. Refer to the GitHub Security Advisory GHSA-6rxf-4hh9-pp46 for vendor-supplied technical details.

Detection Methods for CVE-2026-80195

Indicators of Compromise

Kimai teams that suddenly contain zero members or zero teamleaders without a corresponding administrative action in the audit log.
HTTP PATCH requests to /api/teams/{id} that return a 4xx validation error followed by empty team state.
Loss of access to team-scoped projects, activities, or customers reported by users who were previously assigned.

Detection Strategies

Review application and web server logs for PATCH /api/teams/{id} requests, correlating request bodies against subsequent membership state changes in the database.
Query the Kimai database for teams rows whose associated membership count is zero and compare against expected team rosters.
Alert on validation errors from the team update endpoint that are immediately preceded by delete statements against the team membership table.

Monitoring Recommendations

Instrument the Kimai REST API behind a reverse proxy or web application firewall to capture full request and response metadata for /api/teams/*.
Track authenticated API usage per user account and flag teamleads who invoke team update operations at unusual rates.
Baseline team membership counts and alert on abrupt drops to zero.

How to Mitigate CVE-2026-80195

Immediate Actions Required

Upgrade Kimai to version 2.63.0 or later on all production and staging instances.
Audit every team in the deployment for missing members or teamleaders and restore memberships from backups or historical records where needed.
Review recent API access logs for suspicious PATCH /api/teams/{id} activity and identify any accounts that may have abused the endpoint.

Patch Information

The Kimai maintainers released version 2.63.0 to fix the ordering defect. Details are published in GitHub Security Advisory GHSA-6rxf-4hh9-pp46 and the VulnCheck Advisory for Kimai. Apply the upgrade through the standard Kimai deployment method used in your environment, whether Composer, Docker image, or package.

Workarounds

Restrict the teamlead role to trusted administrative users until the patch can be applied.
Block or rate-limit PATCH requests to /api/teams/{id} at the reverse proxy or web application firewall, allowing only vetted administrative sources.
Take frequent backups of the Kimai database so that any accidental or malicious membership wipe can be restored quickly.

bash

# Configuration example: restrict PATCH /api/teams/{id} at an nginx reverse proxy
location ~ ^/api/teams/[0-9]+$ {
    limit_except GET {
        allow 10.0.0.0/24;   # trusted admin subnet
        deny all;
    }
    proxy_pass http://kimai_upstream;
}