CVE-2026-84804: Kimai Authorization Bypass Vulnerability

CVE-2026-84804 Overview

CVE-2026-84804 is an authorization bypass vulnerability in Kimai time-tracking software before version 2.65.0. The flaw exists in API endpoints that manage team access to activities, projects, and customers. Kimai fails to enforce the required permissions_activity check when authenticated users revoke team access. Users holding only the edit_team permission can remove team assignments they should not be able to modify. The vulnerability maps to [CWE-284: Improper Access Control] and affects the integrity and availability of team-based access controls in shared Kimai deployments.

Critical Impact
Authenticated users with limited permissions can revoke team access to activities, projects, and customers, disrupting time-tracking workflows and access assignments.

Affected Products

Kimai time-tracking application versions prior to 2.65.0
Kimai API endpoints for team activity, project, and customer access management
Self-hosted Kimai deployments exposing the affected API routes

Discovery Timeline

2026-09-02 - CVE-2026-84804 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84804

Vulnerability Analysis

Kimai enforces a permission model that separates team management from activity, project, and customer management. Endpoints that add or modify team access to these resources require both the edit_team permission and the corresponding permissions_activity, permissions_project, or permissions_customer checks. The removal endpoints fail to enforce the second check.

An authenticated user holding only edit_team can send DELETE requests to the team access API and remove team assignments from activities, projects, and customers. The action succeeds despite the user lacking permission to manage those resources. This produces an authorization asymmetry where granting access requires stronger permissions than revoking it.

Root Cause

The root cause is a missing authorization check in the API handlers responsible for removing team access. The code path validates the edit_team permission but omits the paired resource-level permission validation that exists on the corresponding add and update endpoints. This is a classic broken access control pattern where negative operations receive less scrutiny than positive ones.

Attack Vector

Exploitation requires network access to a Kimai instance and valid credentials for an account holding the edit_team permission. The attacker issues API requests to the team access removal endpoints for activities, projects, or customers. No user interaction or elevated privileges beyond edit_team are needed. The result is unauthorized modification of team assignments across the tenant, which can disrupt reporting, billing, and time-tracking data integrity.

The vulnerability is described in prose only. See the GitHub Security Advisory and the VulnCheck Advisory on Kimai for technical details.

Detection Methods for CVE-2026-84804

Indicators of Compromise

Unexpected DELETE requests against Kimai team access API endpoints for activities, projects, or customers from accounts without full administrative rights
Audit-log entries showing team access removals performed by users holding only the edit_team role
User complaints reporting missing team assignments on activities, projects, or customers without corresponding administrative action

Detection Strategies

Correlate Kimai application logs against the user permission matrix to identify team access removals executed by accounts lacking permissions_activity, permissions_project, or permissions_customer
Baseline the normal rate of team access modifications and alert on statistical anomalies from individual accounts
Inspect HTTP access logs on the reverse proxy fronting Kimai for spikes in DELETE requests to /api/teams/*/activities, /api/teams/*/projects, and /api/teams/*/customers

Monitoring Recommendations

Forward Kimai audit logs and web server access logs into a centralized log platform for correlation and retention
Enable alerting on team access changes performed outside change-management windows
Track authentication events for accounts with edit_team permission and review their API activity regularly

How to Mitigate CVE-2026-84804

Immediate Actions Required

Upgrade Kimai to version 2.65.0 or later, which enforces the missing permission checks on team access removal endpoints
Audit accounts holding the edit_team permission and reduce membership to trusted administrators only
Review team access assignments on activities, projects, and customers to confirm no unauthorized removals occurred

Patch Information

The Kimai project addressed the issue in release 2.65.0 by adding the permissions_activity, permissions_project, and permissions_customer checks to the corresponding team access removal endpoints. Patch details are available in the GitHub Security Advisory GHSA-mc86-77vp-82g3.

Workarounds

Temporarily revoke the edit_team permission from non-administrative roles until the upgrade is applied
Restrict network access to the Kimai API to trusted management networks using a reverse proxy or web application firewall
Enable verbose audit logging for team-related API endpoints to support recovery if unauthorized removals occur

bash

# Upgrade Kimai using Composer to the fixed release
composer install --no-dev --optimize-autoloader
bin/console kimai:update --version 2.65.0
bin/console cache:clear --env=prod