CVE-2026-84806
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
- Affected products
- Kimai
- Fix
- Available
- CVSS 3.1
- 5.4 MEDIUM
- EPSS
- 0.1% (4th percentile)
- Weakness
- CWE-732
- NVD status
- Deferred
- Published
- 2026-09-02
CVE-2026-84806 at NVD
No indexed exploits for CVE-2026-84806 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-84806 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.