CVE-2026-84805 Overview
CVE-2026-84805 is a missing authorization vulnerability [CWE-862] in Kimai, an open-source time-tracking application. Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. The web interface enforces the contract_other_profile admin permission, but the WorkContractPreferenceSubscriber introduced in 2.61.0 registers the preferences as enabled without a permission check. Authenticated regular users can invoke the API to modify their own admin-only work-contract data.
Critical Impact
Low-privilege authenticated Kimai users can bypass admin-only permission gates and modify employment-contract preferences on their own accounts through the REST API.
Affected Products
- Kimai 2.61.0
- Kimai versions after 2.61.0 and before 2.63.0
- Fixed in Kimai 2.63.0
Discovery Timeline
- 2026-09-02 - CVE-2026-84805 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84805
Vulnerability Analysis
Kimai exposes user preferences through a REST endpoint at PATCH /api/users/{id}/preferences. Preferences related to employment contracts, including working-time and contract data, are considered administrative and are gated in the web interface by the contract_other_profile permission. Regular users cannot see or edit these fields through the UI.
The API path does not enforce the same control. When WorkContractPreferenceSubscriber was introduced in version 2.61.0, it registered the work-contract preferences as enabled for the current user without evaluating whether that user held the contract_other_profile permission. The API layer relies on that registration to determine which preferences a caller may modify, so registered-but-ungated preferences become writable to any authenticated user.
The impact is limited to integrity of a user's own work-contract preference data. Confidentiality and availability are not affected, and cross-user modification is not described in the advisory.
Root Cause
The root cause is a missing authorization check [CWE-862] in the event subscriber that registers work-contract preferences. Access control was enforced at the presentation layer only, and the API code path bypassed the equivalent server-side check.
Attack Vector
An attacker must hold a valid low-privilege Kimai account. The attacker sends an authenticated PATCH request to /api/users/{id}/preferences where {id} is their own user ID and the JSON body includes the admin-only work-contract preference keys. The server accepts and persists the values because WorkContractPreferenceSubscriber marked those preferences as enabled without a permission check. See the GitHub Security Advisory GHSA-5mpc-5cg2-g99r for technical details.
Detection Methods for CVE-2026-84805
Indicators of Compromise
- PATCH requests to /api/users/{id}/preferences from user accounts that do not hold the contract_other_profile permission.
- Request bodies containing work-contract preference keys submitted by non-admin users.
- Unexpected changes to employment-contract fields on user accounts that lack administrative delegation.
Detection Strategies
- Review application access logs for API traffic to /api/users/*/preferences and correlate the caller's role with the modified preference keys.
- Enable Kimai audit logging and alert on preference mutations that affect work-contract attributes.
- Compare current user preference state against a known-good baseline to identify unauthorized modifications.
Monitoring Recommendations
- Forward Kimai web server and application logs to a centralized log store and retain them for post-incident review.
- Monitor for anomalous API usage patterns from low-privilege accounts, particularly repeated PATCH calls against their own user profile.
- Track upstream releases and advisories via the VulnCheck advisory for follow-up disclosures.
How to Mitigate CVE-2026-84805
Immediate Actions Required
- Upgrade all Kimai instances running versions between 2.61.0 and 2.63.0 to 2.63.0 or later.
- Inventory user accounts and audit work-contract preference values for evidence of tampering.
- Restrict API token issuance to accounts that require programmatic access and rotate tokens for low-privilege users.
Patch Information
The issue is fixed in Kimai 2.63.0 by applying the same contract_other_profile permission check to the API endpoint that the web interface already enforces. Details are documented in the GitHub Security Advisory GHSA-5mpc-5cg2-g99r.
Workarounds
- If immediate upgrade is not possible, block or reverse-proxy filter PATCH requests to /api/users/{id}/preferences for non-admin accounts.
- Limit network exposure of the Kimai API to trusted internal networks or VPN-only access until the patch is applied.
- Review and, where feasible, revoke API tokens for low-privilege users during the mitigation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
