Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. (CVE-2026-84807)

Kimai versions up to 2.65.0 contain a business logic and improper authorization vulnerability (CWE-266) in the POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team endpoints. An authenticated user with project permission-management privileges can create or reference a customer, project, or activity named identically to an existing team. The endpoints then reuse the existing team and add the user as a teamlead without verifying authorization to manage that team, allowing unauthorized elevation to team-lead (administration) rights. This vulnerability is fixed in version 2.65.0.

An attacker with authenticated project permission-management privileges can escalate their access to gain unauthorized team-lead rights over existing teams. This could allow administrative control over team resources that the attacker should not manage. The impact is limited to confidentiality and integrity with no availability impact reported. The CVSS 3.1 base score is 5.4 (medium severity).

Upgrade Kimai to version 2.65.0 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated. Since this is not a cloud service, users must apply the update themselves.