Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: kimai 2.63.0 Clear all filters
TI-2026-58303 CVE-2026-84806 · GHSA-9jvx-vm4p-vv5f

Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Priority LOW 24

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, o…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-02 Fixed in 2.63.0 CWE-732
TI-2026-58302 CVE-2026-84805 · GHSA-785m-wqjq-q2rm

Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Priority LOW 24

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00287 Published 2026-09-02 Fixed in 2.63.0 CWE-862