CVE-2026-84806: Kimai Auth Bypass Vulnerability

CVE-2026-84806 Overview

CVE-2026-84806 is an improper authorization vulnerability in Kimai time-tracking software versions before 2.63.0. The flaw resides in team access endpoints that fail to enforce sufficient permission checks. Authenticated users with team edit permissions and read-only access can send POST requests to modify access control lists for customers, projects, or activities they should not be able to change. The weakness is classified under CWE-732: Incorrect Permission Assignment for Critical Resource.

Critical Impact
Authenticated low-privileged users can grant team access to customers, projects, and activities, bypassing intended authorization boundaries and enabling unauthorized modification of access control lists.

Affected Products

Kimai time-tracking application versions prior to 2.63.0
Self-hosted Kimai deployments exposing team access API endpoints
Multi-tenant Kimai instances with delegated team editors

Discovery Timeline

2026-09-02 - CVE-2026-84806 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84806

Vulnerability Analysis

The vulnerability affects Kimai's team access endpoints, which manage authorization mappings between teams and business entities such as customers, projects, and activities. The application checks whether a user holds team edit permissions but does not verify that the user has write authority over the target entity. As a result, a user with read-only access to a customer, project, or activity can still modify its team access list.

The issue represents a broken access control pattern in which one permission (team edit) is incorrectly treated as sufficient authority to change access control lists on unrelated entities. An attacker with a valid account and minimal privileges can escalate their effective reach into data they were only permitted to view.

Root Cause

The root cause is an incomplete authorization check in the POST handlers for team access endpoints. The code path evaluates the caller's team management capability but omits an entity-level permission check that would confirm write access to the target customer, project, or activity. [CWE-732] describes this pattern of assigning permissions on critical resources without validating the actor's actual authority over each resource.

Attack Vector

Exploitation requires an authenticated session with team edit permission and read-only access to at least one target entity. The attacker issues a POST request to the affected team access endpoint, supplying the target entity identifier and desired team assignment. The server accepts the request and updates the access control list, granting the specified team access to the entity. Successful abuse can be used to widen visibility of billable projects, expose customer data to unauthorized teammates, or manipulate activity assignments used for reporting.

No verified public exploit code is available. Refer to the Kimai GitHub Security Advisory GHSA-gmm9-hfxg-7v29 and the VulnCheck Advisory on Kimai for additional technical detail.

Detection Methods for CVE-2026-84806

Indicators of Compromise

Unexpected POST requests to Kimai team access endpoints originating from accounts with only read-only entity permissions.
Audit log entries showing team access list modifications on customers, projects, or activities the acting user did not create or own.
Sudden appearance of new team-to-entity mappings that do not correspond to administrative change tickets.

Detection Strategies

Review Kimai application and web server logs for POST requests to team access endpoints and correlate the acting user's role with the affected entity's ownership.
Baseline normal team assignment activity and alert on modifications performed by non-administrative accounts.
Compare current team access configuration against a known-good snapshot to identify unauthorized changes.

Monitoring Recommendations

Forward Kimai audit logs to a centralized logging or SIEM platform and retain them for post-incident review.
Alert on any team access list changes performed outside approved administrative windows.
Track authentication events for accounts holding team edit permission to detect account misuse.

How to Mitigate CVE-2026-84806

Immediate Actions Required

Upgrade Kimai to version 2.63.0 or later, which contains the corrected authorization check.
Audit existing team-to-entity assignments for unauthorized additions made prior to patching.
Review and reduce the number of accounts that hold team edit permission to the minimum required.

Patch Information

The vulnerability is resolved in Kimai 2.63.0. Administrators should follow the upgrade guidance in the Kimai GitHub Security Advisory GHSA-gmm9-hfxg-7v29. After upgrading, verify that team access endpoints enforce entity-level write permission checks by testing with a low-privileged account.

Workarounds

Restrict access to Kimai's team management functionality to trusted administrators until the upgrade is applied.
Place Kimai behind a reverse proxy or web application firewall that can log and rate-limit requests to team access endpoints.
Revoke team edit permission from accounts that also hold read-only access to sensitive customers, projects, or activities.

bash

# Verify installed Kimai version and upgrade if below 2.63.0
grep -R "'version'" /var/www/kimai/config/ | head -n 5
cd /var/www/kimai && git fetch --tags && git checkout 2.63.0
composer install --no-dev --optimize-autoloader
bin/console kimai:update