Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. (CVE-2026-84804)
Description
Kimai versions before 2.65.0 have a vulnerability where permission validation is insufficient when removing team access to activities, projects, and customers via API endpoints. Authenticated users with the edit_team permission can revoke team access without undergoing the required permissions_activity check, allowing them to bypass authorization controls.
CVSS v3.1
Score 5.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kimai before version 2.65.0 does not properly validate permissions when an authenticated user with edit_team permission attempts to remove team access to activities, projects, and customers through API endpoints. This flaw allows such users to bypass the intended authorization checks related to permissions_activity, potentially enabling unauthorized modification of team access controls.
Potential Impact
The vulnerability allows authenticated users with edit_team permission to revoke team access without proper authorization checks, leading to unauthorized modification of access controls. This can result in integrity and availability impacts, such as improper denial of access to activities, projects, or customers for teams. Confidentiality is not impacted according to the CVSS vector.
Mitigation Recommendations
No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict edit_team permissions to trusted users only to minimize risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xcvc-fv83-5g8g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84804"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a98451eacd9273b496a9bb2
Added to database: 09/02/2026, 15:47:42 UTC
Last enriched: 09/08/2026, 02:53:52 UTC
Last updated: 10/16/2026, 06:48:19 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.