Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck

CVE-2026-84805Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Medium 4.3

In plain English

A medium-severity missing authorization in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	2.61.0 – before 2.63.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-5mpc-5cg2-g99r) vendor-advisory
VulnCheck Advisory: Kimai 2.61.0 before 2.63.0 Authentication Bypass via API third-party-advisory