CVE-2026-84807 Overview
CVE-2026-84807 is an improper authorization vulnerability in Kimai (kimai/kimai) time-tracking software through version 2.65.0. The flaw resides in the default team creation endpoints. An authenticated user with project permission-management privileges can create a customer, project, or activity whose name matches an existing team. The endpoints reuse the existing team of the same name and add the current user as team lead without verifying authorization. The attacker gains team-lead administration rights over teams they do not own. The issue is fixed in version 2.65.0 and classified under [CWE-266: Incorrect Privilege Assignment].
Critical Impact
An authenticated low-privileged user can escalate to team-lead (administrator) of any existing team by matching its name during customer, project, or activity creation.
Affected Products
- Kimai (kimai/kimai) versions prior to 2.65.0
- Self-hosted Kimai deployments exposing REST API endpoints
- Kimai instances with users holding project permission-management rights
Discovery Timeline
- 2026-09-02 - CVE-2026-84807 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84807
Vulnerability Analysis
The vulnerability is a business logic and improper authorization flaw in the Kimai REST API. Three endpoints are affected:
- POST /api/customers/{id}/team
- POST /api/projects/{id}/team
- POST /api/activities/{id}/team
When an authenticated user invokes any of these endpoints, Kimai attempts to associate a team with the target customer, project, or activity. If a team with the supplied name already exists, the application reuses that team instead of creating a new one. During this reuse path, the endpoint adds the calling user as team lead without checking whether the user is authorized to manage the pre-existing team. The attacker inherits administrative control over the team's members, associated projects, customers, and activities.
Root Cause
The root cause is a missing authorization check on the team-reuse code path. The authorization logic validates the user's permission to create a new team but does not re-validate authorization when the request resolves to an existing team by name. The team lead assignment step trusts the resolved team object regardless of ownership.
Attack Vector
Exploitation requires an authenticated account with project permission-management privileges. The attacker enumerates or guesses the name of a target team. The attacker then issues a POST request to one of the vulnerable endpoints, supplying the target team name as the team parameter. The backend resolves the name to the existing team and appends the attacker as team lead. From that point, the attacker can manage team membership, remove the legitimate lead, and access resources scoped to the team. No user interaction is required beyond the attacker's own authenticated session. Refer to the GitHub Security Advisory GHSA-hvq2-5gh2-rgvv and the VulnCheck advisory for additional technical detail.
Detection Methods for CVE-2026-84807
Indicators of Compromise
- Unexpected POST requests to /api/customers/{id}/team, /api/projects/{id}/team, or /api/activities/{id}/team from low-privileged users.
- Audit log entries showing a user becoming team lead of a team they did not previously belong to.
- Team membership changes clustered around customer, project, or activity creation events by the same account.
Detection Strategies
- Correlate application access logs with Kimai's internal audit trail to flag team-lead assignments that follow customer, project, or activity creation by the same user within a short window.
- Alert on POST requests to the three vulnerable team endpoints where the resolved team predates the calling user's account.
- Review database records for teams where the teamlead field was modified without a corresponding administrator-initiated action.
Monitoring Recommendations
- Enable verbose request logging on the Kimai API tier and forward logs to a centralized SIEM.
- Baseline normal team-management activity per role and alert on deviations, especially team-lead additions performed by non-administrators.
- Monitor for privilege changes on sensitive teams tied to customer billing or executive projects.
How to Mitigate CVE-2026-84807
Immediate Actions Required
- Upgrade Kimai to version 2.65.0 or later where the authorization check on the team-reuse path is enforced.
- Audit all existing teams for unauthorized team-lead assignments and revoke any that cannot be attributed to a legitimate administrator action.
- Restrict which users hold project permission-management privileges until the upgrade is complete.
Patch Information
The vulnerability is fixed in Kimai 2.65.0. The fix adds authorization verification when the team creation endpoints resolve to an existing team by name, preventing unauthorized team-lead assignment. See the GitHub Security Advisory GHSA-hvq2-5gh2-rgvv for release details.
Workarounds
- Temporarily revoke project permission-management privileges from non-administrative users until the patch is deployed.
- Place the Kimai API behind a reverse proxy that blocks POST requests to /api/customers/*/team, /api/projects/*/team, and /api/activities/*/team from non-administrator sessions.
- Rename sensitive teams to non-predictable identifiers to reduce the ability of an attacker to guess existing team names.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
