Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck

CVE-2026-84807Kimai before 2.65.0 Authentication Bypass via Team Creation

Medium 5.4

In plain English

A medium-severity security flaw in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	0 – before 2.65.0

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-hvq2-5gh2-rgvv) vendor-advisory
VulnCheck Advisory: Kimai before 2.65.0 Authentication Bypass via Team Creation third-party-advisory