Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-84805— Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Quick assessment

Affected

kimai kimai

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kimai 2.61.0 至 2.62.9（即 2.63.0 之前）版本在接口中无法为低权限用户禁用仅限管理员的工作合同偏好设置。尽管 Web 界面通过管理员权限对这些劳动合同字段进行了访问控制，但在 2.61.0 中引入的未做权限检查，直接将偏好设置为启用状态。因此，已认证的普通用户可通过 API 修改自己的仅限管理员的工作合同数据。该问题已在 2.63.0 中修复，修复方式为在 API 接口上应用相同的权限检查。

CVSS 4.3 · Medium Updated Sep 02, 2026

Possible ATT&CK Techniques 1 AI

T1578 · Modify Cloud Compute Infrastructure

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Source: CVE Program / CVE List V5

Vulnerability Description

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
kimai	kimai	2.61.0 ~ 2.63.0	-

II. Public POCs for CVE-2026-84805

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-84805

请登录查看更多情报信息。

Other References for CVE-2026-84805 (2)

Regular users can set admin-only work-contract fields via API · Advisory · kimai/kimai · GitHub vendor-advisory
Kimai 2.61.0 before 2.63.0 Authentication Bypass via API | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-84805

Same Patch Batch · kimai · 2026-09-02 · 5 CVEs total

CVE-2026-84807	5.4 MEDIUM	Kimai before 2.65.0 Authentication Bypass via Team Creation
CVE-2026-84806	5.4 MEDIUM	Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
CVE-2026-84804	5.4 MEDIUM	Kimai before 2.65.0 Authorization Bypass via Team Activity API
CVE-2026-84808	4.3 MEDIUM	Kimai before 2.65.0 Authorization Bypass via API Timesheet

IV. Related Vulnerabilities

Same product: kimai

Same vendor: kimai

Same weakness: CWE-862

V. Comments for CVE-2026-84805

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-84805— Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-84805

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-84805

III. Intelligence Information for CVE-2026-84805

Other References for CVE-2026-84805 (2)

Same Patch Batch · kimai · 2026-09-02 · 5 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-84805

Leave a comment