Is CVE-2026-84805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84805 being exploited in the wild.

How severe is CVE-2026-84805?

Medium severity, with a CVSS score of 4.3, published 2 September 2026.

Is there a fix for CVE-2026-84805?

A patch was published on 2026-09-02: Fix available in version 2.63.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84805 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84805?

Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84805: Kimai missing authorization in work-contract preferences API

CVE-2026-84805 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Kimai is a time-tracking application used by organizations to log employee work hours and contract terms. A vulnerability allows regular employees to modify their own employment contract details through the API, even though only administrators should have this permission. An authenticated user can bypass the web interface restrictions to change sensitive contract data like employment status or terms.

Technologies: Kimai. Vendors: Kimai.

Quick answers

Is CVE-2026-84805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84805 being exploited in the wild.
How severe is CVE-2026-84805?: Medium severity, with a CVSS score of 4.3, published 2 September 2026.
Which products and versions are affected?: Kimai 2.61.0 to 2.62.x.
Is there a fix for CVE-2026-84805?: A patch was published on 2026-09-02: Fix available in version 2.63.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84805 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84805?: Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the PATCH /api/users/{id}/preferences endpoint. The WorkContractPreferenceSubscriber component, introduced in version 2.61.0, registers work-contract preferences as enabled by default without verifying the contract_other_profile admin permission. Although the web interface correctly gates these fields behind admin-only checks, the API endpoint fails to enforce the same permission validation, allowing any authenticated regular user to modify work-contract preference data via direct API calls. The fix, available in version 2.63.0, applies the required permission check to the API endpoint.

Affected products

Kimai Kimai 2.61.0 to 2.62.x

Timeline

2026-08-19: disclosed: GitHub Security Advisory GHSA-5mpc-5cg2-g99r published
2026-09-02: advisory: CVE-2026-84805 published in NVD
2026-09-02: patched: Fix available in version 2.63.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.