medium4.3
CVE-2026-84808
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team ac…
Impact
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
Affected products
| Product | Affected versions |
|---|---|
| Kimai | before 2.65.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.