Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit… (CVE-2026-84806)

Kimai before version 2.63.0 has an improper authorization vulnerability (CWE-732) in its team access endpoints. Authenticated users who have team edit permissions combined with read-only access can exploit insufficient permission validation by sending POST requests to modify access control lists for customers, projects, or activities beyond their authorized scope. This flaw enables unauthorized privilege escalation within team access management.

The vulnerability allows authenticated users with limited permissions to escalate their access by modifying team access control lists improperly. This can lead to unauthorized access to customers, projects, or activities, potentially compromising confidentiality and integrity of data within Kimai. There is no indication of availability impact or known exploits in the wild.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict team edit permissions carefully and monitor for unauthorized access attempts related to team access modifications.