CVE-2026-84808
Last modified
CVE-2026-84808 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation..
Description
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| kimai | kimai | < 2.65.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-84808?
How severe is CVE-2026-84808?
How do I fix CVE-2026-84808?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84802Craft CMS versions from 5.7.0 before 5.10.12 contain an info…4.3
- CVE-2026-84803SiYuan before v3.8.2 contains a stored cross-site scripting …9
- CVE-2026-84804Kimai before 2.65.0 fails to properly validate permissions w…5.4
- CVE-2026-84805Kimai versions from 2.61.0 before 2.63.0 fail to disable adm…4.3
- CVE-2026-84806Kimai before 2.63.0 contains an improper authorization vulne…5.4
- CVE-2026-84807Kimai (kimai/kimai) through 2.65.0 contains a business logic…5.4
- CVE-2026-84809Tencent AI-Infra-Guard's skill-scan component excludes compi…6.5
- CVE-2026-8481IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical rem…9.9
- CVE-2026-84810claude-skill-antivirus fails to analyze executable files whe…6.5
- CVE-2026-84811agentverus-scanner fails to analyze compiled Python bytecode…6.5
- CVE-2026-84812Unauthenticated Cross Site Scripting (XSS) in BP Better Mess…7.1
- CVE-2026-84813Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 ver…9.3
Are you affected by CVE-2026-84808?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST