VULNERABILITY INTELLIGENCE

CVE-2026-84806

CVSS score5.3 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-09-02
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

Weakness classification

  • CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references