Quick answers
- Is CVE-2026-84807 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84807 being exploited in the wild.
- How severe is CVE-2026-84807?
- Medium severity, with a CVSS score of 5.4, published 2 September 2026.
- Which products and versions are affected?
- Kimai through 2.65.0.
- Is there a fix for CVE-2026-84807?
- A patch was published on 2026-09-02: fixed in version 2.65.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84807 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-84807?
- Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a business logic and improper authorization vulnerability (CWE-266, CWE-863) in Kimai's team creation API endpoints. The vulnerable endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team) reuse existing teams matching the name of the resource being created and automatically add the requesting user as teamlead, without verifying the user has authorization to manage that team. Attack requires network access and authentication with project permission-management privileges. An attacker can exploit this to gain unauthorized team-lead (administrative) rights over existing teams. The vulnerability was patched in version 2.65.0 by removing team reuse logic and moving team creation to the web interface where teams are always created fresh.
Affected products
- Kimai Kimai through 2.65.0
Timeline
- 2026-08-19: disclosed
- 2026-09-02: advisory
- 2026-09-02: patched: fixed in version 2.65.0