Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH… (CVE-2026-84805)
Description
Kimai versions from 2.61.0 up to but not including 2.63.0 contain a vulnerability where low-privilege users can modify admin-only work-contract preferences via the PATCH /api/users/{id}/preferences API endpoint. This occurs because the API endpoint does not enforce the same permission checks as the web interface, allowing authenticated regular users to change admin-only data. The issue is fixed in version 2.63.0 by adding the appropriate permission checks to the API.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kimai versions starting at 2.61.0 and before 2.63.0 fail to properly restrict access to admin-only work-contract preferences in the PATCH /api/users/{id}/preferences API endpoint. Although the web interface restricts these fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber registers these preferences as enabled without verifying permissions. Consequently, authenticated users with low privileges can modify their own admin-only work-contract data via the API. This vulnerability is addressed in version 2.63.0 by implementing the same permission checks on the API endpoint.
Potential Impact
An authenticated user with low privileges can modify admin-only work-contract preferences via the API, potentially leading to unauthorized changes in employment-contract data. The vulnerability does not impact confidentiality or availability but allows integrity modification of restricted user preferences.
Mitigation Recommendations
Upgrade Kimai to version 2.63.0 or later, where the vulnerability is fixed by applying proper permission checks to the PATCH /api/users/{id}/preferences API endpoint. No other mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-785m-wqjq-q2rm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84805"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a984520acd9273b496a9ca4
Added to database: 09/02/2026, 15:47:44 UTC
Last enriched: 09/08/2026, 02:39:09 UTC
Last updated: 10/15/2026, 18:48:24 UTC
Views: 30
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.