CVE-2026-84808: Kimai

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

Affected products

• Kimai Kimai: before 2.65.0 (fixed in 2.65.0)

Published 2026-09-02. Last modified 2026-09-02.