CVE-2026-84804

Executive Summary

CVE-2026-84804 is an authorization bypass vulnerability in Kimai, an open-source time-tracking application, affecting all versions prior to 2.65.0. The flaw resides in the improper validation of permissions when authenticated users with the edit_team permission remove team access to activities, projects, and customers via API endpoints, allowing them to bypass the required permissions_activity authorization check. With a CVSS score of 5.4 (Medium), the vulnerability enables low-privileged authenticated users to modify team access controls that should be restricted, leading to unauthorized integrity and availability impacts on shared project data. No public proof-of-concept, exploit code, or vendor patch is currently available, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability exists in Kimai's permission-handling logic when processing API requests to remove team access. Kimai implements a granular permission system where certain operations—such as modifying team assignments for activities, projects, and customers—require specific permission checks (in this case, a check referred to as permissions_activity). However, prior to version 2.65.0, the code path handling team-access removal fails to execute this critical verification step.

Vulnerability Mechanism: The core issue is a missing authorization check on the "remove team access" operation. When an authenticated user issues an API request to revoke team access to an entity (activity, project, or customer), the application only verifies that the user holds the general edit_team permission. It does not subsequently validate that the user possesses the more granular permissions_activity permission, which is intended to gate such modifications. This constitutes an improper authorization check (CWE-284: Improper Access Control), where the application relies on insufficient permission validation logic.

Attack Surface: The vulnerability is exploitable via the API endpoints that handle team-access modifications. Because the flaw is in the API layer, it is remotely reachable over the network (AV:N). The attacker must authenticate first (PR:L), but no user interaction is required (UI:N). The attack complexity is low (AC:L), meaning no special conditions need to be staged beyond possessing a valid low-privileged account with the edit_team permission.

Affected Entities: The flaw affects three resource types:

• Activities (time-tracking activities)
• Projects (parent containers for activities)
• Customers (organizations/entities for which projects are executed)

The edit_team permission in Kimai is typically granted to users who can manage team compositions but is not intended to confer the right to modify resource-level team access across all entity types. The missing permissions_activity check means the boundary between these two permission levels is not enforced.

Technical Context: Kimai uses a bundle/plugin-based architecture where the core permission system maps user roles to fine-grained capabilities. Team access control allows administrators to share specific projects, activities, or customer data with subsets of users. The vulnerability allows a user with a lower-tier permission (edit_team) to perform actions reserved for higher-privilege roles, effectively escalating their control over data-sharing configuration.

Exploitation Scenarios

Note: No public PoC or exploit code is available. The following attack chain is inferred from the NVD description and the vulnerability class (missing authorization check in an API endpoint).

1. Reconnaissance / Target Identification: An attacker with a valid low-privileged Kimai account (e.g., a team member granted edit_team permission for day-to-day team management) first identifies which API endpoints handle team-access removal. The attacker likely enumerates API routes related to team and permission management, testing various entity IDs (customers, projects, activities) to map which resources are associated with which teams. Tools such as Burp Suite, Postman, or custom scripts can be used to inspect API responses and identify valid endpoint structures.

2. Triggering the Flaw: The attacker authenticates to the Kimai API and issues a request to revoke team access from a target entity. Critical to the attack is that the request targets an entity type (e.g., a project belonging to a customer outside the attacker's administrative remit) for which the removal action should normally require the permissions_activity permission. Because the vulnerable code path only checks for the edit_team permission, the request succeeds without triggering an authorization denial.

3. Payload / Execution Method (Class-level): The attack operates at the API request manipulation level. The attacker crafts a standard API call to the team-access removal endpoint, supplying:

• An entity type (activity, project, or customer)
• A specific entity ID
• The team ID from which access is to be revoked

No injection or memory corruption is involved. The "payload" is simply a legitimate API request that the server erroneously authorizes due to the insufficient permission check. The attacker may repeat this across multiple entities to maximise impact.

4. Post-Exploitation Impact: Successful exploitation results in unintended revocation of team access to activities, projects, or customers. This yields two primary consequences:

• Integrity Impact (Low): The team-access configuration is altered in a way that does not reflect the intent of the resource owner or administrator. Legitimate team members may lose access to shared resources or, conversely, access boundaries may be modified in unintended ways.
• Availability Impact (Low): Revoking team access can lock legitimate users out of resources they need for their work, causing operational disruption in time-tracking, project management, or billing workflows.

If an attacker controls a team and removes access for another team from a shared project, the other team loses visibility into and ability to record time against that project, potentially halting their time-entry activities.

Impact Assessment

Business Impact: For organisations using Kimai to manage time tracking across multiple project teams, customers, and activities, this vulnerability undermines the integrity of team-based access control. A user with only edit_team permission—typically a team lead or manager—can inadvertently or maliciously remove team access from resources managed by other teams or departments. This can lead to:

• Disrupted time-entry workflows when teams lose access to projects
• Incorrect billing data if teams cannot access customer projects
• Administrative overhead in re-validating and restoring access configurations

Affected Systems: All Kimai deployments running versions earlier than 2.65.0 with API access enabled and the edit_team permission assigned to any authenticated user. The vulnerability specifically targets the API endpoints managing team access to activities, projects, and customers.

Blast Radius: Medium. CVSS 5.4 reflects the requirement for prior authentication and the limited (though real) integrity and availability impacts. The confidentiality impact is none (C:N), meaning data is not directly disclosed. However, the integrity and availability impacts can propagate across teams that share projects, expanding the operational blast radius beyond the immediate attacker's team. The scope is unchanged (S:U) — the compromise does not extend to other security contexts.

The attack requires the attacker to possess an account with edit_team permission. In Kimai's permission model, this is typically granted to project managers or team administrators, meaning the pool of potential attackers is any user with those credentials — including legitimate employees who may hold a grudge, or accounts that have been compromised through other means (phishing, credential stuffing).

Detection Guidance

The vulnerability is triggered by authenticated API requests. Detection should focus on anomalous patterns in API access related to team/permission endpoints.

Sigma Rule

title: Kimai API Team Access Removal - Potential Authorization Bypass
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects API requests to remove team access in Kimai that may indicate exploitation of CVE-2026-84804 (missing permissions_activity check)
logsource:
  category: web
  product: kimai
detection:
  selection:
    cs-method: 'DELETE'  # or POST depending on API design
    c-uri|contains:
      - '/api/teams/'
      - '/api/activities/'
      - '/api/projects/'
      - '/api/customers/'
  keywords:
    - 'removeTeam'
    - 'revoke'
    - 'detachTeam'
  filter_known_users:
    c-username|startswith: 'admin'
  condition: selection and not filter_known_users
level: medium
falsepositives:
  - Legitimate team administrator removing access incorrectly
  - High-privileged users (super admin) performing normal operations
tags:
  - attack.t1222
  - cve.2026.84804

YARA Rule

rule kimai_cve_2026_84804_authz_bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect patterns in Kimai source code indicating missing authorization check for team access removal"
        cve = "CVE-2026-84804"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84804"
        severity = "medium"
    strings:
        // Look for edit_team permission checks without corresponding permissions_activity checks
        $perm_check = "edit_team" ascii nocase
        $vuln_pattern1 = "removeTeamAccess" ascii
        $vuln_pattern2 = "revokeTeam" ascii
        $vuln_pattern3 = "deleteTeamAccess" ascii
        $missing_check = "permissions_activity" ascii
        $api_controller = "TeamAccessController" ascii
        
        // API endpoint path patterns
        $api_path1 = "/api/teams" ascii
        $api_path2 = "/api/activities" ascii
        $api_path3 = "/api/projects" ascii
        $api_path4 = "/api/customers" ascii
    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x464C457F
        and $api_controller
        and $perm_check
        and any of ($vuln_pattern*)
        and not any of ($missing_check)  // Missing permissions_activity check is suspicious
        and any of ($api_path*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84804 Kimai API Team Access Removal - Possible Authorization Bypass"; flow:established,to_server; content:"DELETE"; http_method; content:"/api/"; http_uri; content:"teams"; http_uri; content:"access"; http_uri; content:"removeTeam"; http_uri; content:"revision"; http_uri; reference:cve,2026-84804; classtype:attempted-admin; sid:1008484; rev:1;)

Note: The above rule targets HTTP DELETE requests to URLs containing /api/ with teams and access in the path. As no specific API endpoint structure is provided, adjust content matches to the observed API URI patterns in the Kimai deployment.

Elastic Detection

// Detect API calls to remove team access from entities
sequence by user.name, source.ip
  with maxspan=5m
  [authentication where event.outcome == "success" and user.name != null]
  [auditbeat where process.name == "php-fpm" or event.module == "apache" or event.module == "nginx"
   and http.request.method == "DELETE"
   and url.path in ("/api/teams/*", "/api/activities/*", "/api/projects/*", "/api/customers/*")
   and (url.path like "*remove*" or url.path like "*access*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="DELETE" AND uri_path IN ("/api/teams/*", "/api/activities/*", "/api/projects/*", "/api/customers/*")
| search uri_path="*access*" uri_path="*remove*"
| lookup user_permissions user_id as user OUTPUT permission_flag
| where permission_flag="edit_team" role!="ADMIN_ROLE"
| stats count by user, src_ip, uri_path, _time
| table _time, user, src_ip, uri_path, count
| sort - _time

Wazuh OSSEC Rule

<group name="kimai,">
  <rule id="100848" level="10">
    <decoded_as>json</decoded_as>
    <field name="method">DELETE</field>
    <field name="url">\./api/(teams|activities|projects|customers)/.*</field>
    <description>CVE-2026-84804: Kimai API team access removal request detected - possible authorization bypass</description>
    <mitre><id>T1222</id></mitre>
    <group>authentication_failures,</group>
    <info type="cve">2026-84804</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence from any tracked source. The vulnerability affects Kimai versions prior to 2.65.0; the fix is anticipated in that release version.

1. Immediate Mitigations (compensating controls)

• Restrict the edit_team permission: Audit all user roles and remove the edit_team permission from any account that does not absolutely require it for daily operations. Treat this permission as high-privilege until the patch is applied.
• Disable API access to affected endpoints: Where feasible, configure a web application firewall (WAF) or reverse proxy rule to block DELETE requests targeting /api/teams/, /api/activities/, /api/projects/, or /api/customers/ URLs containing access-removal keywords, except from allowed administrative IP ranges.
• Monitor API audit logs: Enable verbose logging for API requests and review logs for unauthorised team-access removal attempts. Alert on any request originating from accounts with only edit_team permission (not full admin) targeting team modifications.
• Enforce additional authentication factors: Require MFA or re-authentication for privileged API operations if Kimai supports such configuration.

2. Patch/Upgrade Steps

• Upgrade to Kimai 2.65.0 or later as soon as it becomes available from the vendor. Monitor the official Kimai GitHub releases page and the project's security advisories for the patch announcement.
• Verify patch integrity: After upgrading, validate the SHA-256 checksum of the release archive against the vendor-published value.
• Test the patch: In a staging environment, reproduce the attack scenario (attempting to remove team access with edit_team but without permissions_activity permission) to confirm the authorization check is now enforced.

3. Long-Term Hardening

• Implement the principle of least privilege: Conduct a periodic review of all Kimai user roles and permissions. Ensure that granular permissions like permissions_activity are never implicitly granted alongside broader team-management permissions.
• Enable full audit logging: Configure Kimai to maintain immutable audit trails of all permission-related changes, including successful and failed attempts.
• Network segmentation: Restrict access to the Kimai API endpoints to trusted internal networks, VPNs, or SSO-protected ingress paths only.
• Regular vulnerability scanning: Include Kimai in the organisation's vulnerability management program. Use authenticated scanners that can identify application-level authorization issues.
• Subscribe to vendor notifications: Follow the Kimai project's security mailing list or GitHub watch on the repository for immediate alerts about future security releases.
• Incident response preparation: Update the IR runbook to include scenarios where a legitimate user's permissions are abused. Test response procedures for re-validating team access configuration after any suspected compromise.

References

1. NVD Entry — CVE-2026-84804 — National Vulnerability Database (NVD) description and CVSS metrics.
2. Kimai Offical Site — Kimai Time Tracking — Vendor product page; check for security advisories and release announcements.
3. Kimai GitHub Repository — kimai/kimai Releases — Track release 2.65.0 and confirm whether it includes the security fix for this CVE.
4. CWE Entry — CWE-284: Improper Access Control — Weakness classification used for this vulnerability.
5. MITRE ATT&CK — T1222 — File and Directory Permissions Modification — Associated tactic-technique mapping used for detection.

Threat Intelligence Notes: No known active exploitation campaigns, exploit-in-the-wild evidence, or threat-actor targeting of this CVE have been identified as of the reporting date. The vulnerability is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS has not yet scored this CVE, reflecting the very recent disclosure and absence of observed exploitation. Organisations running Kimai self-hosted deployments should nonetheless prioritise remediation given the authenticated-by-design nature of the flaw and the decreasing time-to-exploitation observed for similar authorization-bypass CVEs in the current threat landscape.