# CVE-2026-84808: Kimai REST API timesheet authorization bypass in activity-team access controls

Source: https://junglewise.ai/threats/cve-2026-84808-kimai-rest-api-timesheet-authorization-bypass-in-activity-team  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84808 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Kimai is an open-source time-tracking application used by organizations to log and manage employee work hours. A flaw in the REST API allows users with basic access permissions to view timesheets from activities they should not have access to, bypassing team-based data isolation controls. This could expose sensitive timesheet data across team boundaries in multi-tenant environments.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai).

## Quick answers

**Is CVE-2026-84808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84808 being exploited in the wild.

**How severe is CVE-2026-84808?** Medium severity, with a CVSS score of 4.3, published 2 September 2026.

**Which products and versions are affected?** Kimai before 2.65.0.

**Is there a fix for CVE-2026-84808?** A patch was published on 2026-09-02: Version 2.65.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84808 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84808?** Check whether you run Kimai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the GET /api/timesheets endpoint of Kimai's REST API. The TimesheetRepository's addPermissionCriteria() method checked project and customer team membership but failed to enforce activity-team access controls. A user with the view_other_timesheet permission (default for ROLE_TEAMLEAD) can list timesheets that use activities restricted to teams they do not belong to, whereas the single-entity GET /api/timesheets/{id} endpoint correctly enforces these restrictions. The attack requires authentication (view_other_timesheet permission) and network access to the API. The fix adds activity constraint validation to addPermissionCriteria(), patched in version 2.65.0.

## Affected products

- Kimai Kimai before 2.65.0

## Timeline

- 2026-08-19: disclosed: Security advisory published on GitHub
- 2026-09-02: patched: Version 2.65.0 released with fix

## References

- [https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw](https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw)
- [https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-timesheet](https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-timesheet)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)