Vulnerability in Kimai
CVE-2026-84806
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (14.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 14.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/kimai/kimai/security/advisories/GHSA-gmm9-hfxg-7v29 (vendor-advisory)
- www.vulncheck.com/advisories/kimai-before-2.63.0-authorization-bypass-via-team-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-84806?
- CVE-2026-84806 is a medium-severity vulnerability in Kimai, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 5.4/10. Published 2026-09-02.
- How severe is CVE-2026-84806?
- Medium severity. CVSS v3 base score is 5.4 out of 10.