Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: kimai 2.65.0 Clear all filters
TI-2026-58305 CVE-2026-84808 · GHSA-c4jr-h3rc-c3hg

Kimai before 2.65.0 Authorization Bypass via API Timesheet

Priority LOW 24

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00305 Published 2026-09-02 Fixed in 2.65.0 CWE-863
TI-2026-58304 CVE-2026-84807 · GHSA-p3c7-g2jr-3m35

Kimai before 2.65.0 Authentication Bypass via Team Creation

Priority LOW 24

Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-09-02 Fixed in 2.65.0 CWE-266
TI-2026-58301 CVE-2026-84804 · GHSA-xcvc-fv83-5g8g

Kimai before 2.65.0 Authorization Bypass via Team Activity API

Priority LOW 24

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00326 Published 2026-09-02 Fixed in 2.65.0 CWE-284