Executive brief
Kimai is a time-tracking application used by organizations to log employee work hours and contract terms. A vulnerability allows regular employees to modify their own employment contract details through the API, even though only administrators should have this permission. An authenticated user can bypass the web interface restrictions to change sensitive contract data like employment status or terms.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the PATCH /api/users/{id}/preferences endpoint. The WorkContractPreferenceSubscriber component, introduced in version 2.61.0, registers work-contract preferences as enabled by default without verifying the contract_other_profile admin permission. Although the web interface correctly gates these fields behind admin-only checks, the API endpoint fails to enforce the same permission validation, allowing any authenticated regular user to modify work-contract preference data via direct API calls. The fix, available in version 2.63.0, applies the required permission check to the API endpoint.
Affected products
- Kimai Kimai 2.61.0 to 2.62.x
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-5mpc-5cg2-g99r published
- 2026-09-02: advisory: CVE-2026-84805 published in NVD
- 2026-09-02: patched: Fix available in version 2.63.0