CVE-2026-84808

Executive Summary

CVE-2026-84808 is an authorization bypass vulnerability affecting Kimai, an open-source time-tracking application, in all versions prior to 2.65.0. The flaw resides in the REST API timesheet collection endpoint, which fails to enforce activity-team access controls when a user holds the view_other_timesheet permission. This allows an authenticated low-privileged user to list timesheets that reference activities restricted to teams the user does not belong to, thereby bypassing intended data isolation boundaries. The vulnerability has a CVSS base score of 4.3 (Medium) and requires an authenticated account with the view_other_timesheet permission; no public exploit code or proof-of-concept is currently available, and the issue remains unpatched in all shipped versions prior to 2.65.0.

Technical Analysis

The vulnerability is a classic broken access control issue, classified under CWE-863 (Incorrect Authorization). Kimai implements a team-based access control model wherein activities (work items tracked against projects) can be restricted to specific teams. Users outside a designated team should not be able to view or manipulate timesheets referencing those team-restricted activities, even if the user holds elevated permissions such as view_other_timesheet (which otherwise permits viewing timesheets of other users).

The flaw exists in the REST API timesheet collection endpoint. The NVD description indicates that when this endpoint filters or queries timesheet records, it checks the user’s view_other_timesheet permission to authorize the request but does not subsequently enforce activity-team membership restrictions on the result set. In architectural terms, this is a missing secondary authorization check at the data-filtering layer. The endpoint likely performs a permission-based gate at the controller level (checking view_other_timesheet), then queries the timesheet repository without joining or filtering against the requesting user’s team membership for the associated activity objects. As a result, a user who legitimately holds view_other_timesheet (e.g., a team supervisor or manager) can expand their read scope horizontally across team boundaries.

Attack surface details:

• Authentication required: Yes (REST API with user credentials — API tokens or session).
• Privilege required: Low (PR:L) — any authenticated user with the view_other_timesheet permission assigned to their role.
• Affected endpoint: Timesheet collection endpoint in the REST API (exact URI path not disclosed in the CVE description; due to accuracy constraints, no path is invented here).
• Access control flaw: Missing activity-team enforcement on the collection result set.
• Data exposure: Timesheet entries metadata including activity association, user association, duration, timestamps, and potentially cost/revenue fields depending on API response configuration.

The authorization model failure is subtle: the API correctly verifies that the requesting principal may view other users’ timesheets (view_other_timesheet), but it fails to intersect that with the team-restriction rules on the activities referenced by those timesheets. In multi-tenant or departmental deployments of Kimai, this flaw breaks the confidentiality boundary between teams.

No further code-level detail (specific function names, request parameters, or repository method names) is available from the NVD description. The mechanism described above is inferred strictly from the vulnerability class and the description’s wording.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this vulnerability. The following attack chain is inferred from the vulnerability class and NVD description; it should be validated by security testing against a staging environment.

Step 1 — Reconnaissance / Target Identification: The attacker first identifies a Kimai instance. This can be done via Shodan using the fingerprint dorks listed in the metadata (http.title:"Kimai"), or by fingerprinting the login page and application metadata. The attacker confirms the version is < 2.65.0 — observable via https://target/var/ directory listings, changelog files, or the version field exposed in the application footer or via the API /api/version endpoint (if exposed unauthenticated).

Step 2 — Authentication / Preparation: The attacker must obtain a valid account with the view_other_timesheet permission. Options include:

• A legitimate low-privilege account issued to a contractor or junior staff member in one team who possesses the view_other_timesheet assignment (typical for supervisors or cross-functional coordinators).
• Compromised credentials from phishing, credential stuffing, or open password reuse.
• An insider threat actor operating with an existing account.

The attacker authenticates to the REST API and obtains a valid API session or bearer token.

Step 3 — Triggering the Flaw: The attacker issues a GET request against the timesheet collection endpoint (e.g., /api/timesheets — representational, not confirmed in description). Critically, the attacker includes query parameters to enumerate timesheets. Because the endpoint honors view_other_timesheet to list records belonging to multiple users but omits the activity-team scope filter, the response will include timesheet objects whose associated activities belong to teams the attacker is not a member of.

Step 4 — Data Exfiltration / Post-Exploitation Impact: The attacker iterates through paginated responses to collect timesheets from other teams. This yields:

• Cross-team visibility: Timesheets belonging to other departments — exposes who is working on what restricted activity, work hours, project codes, and billing rates.
• Privilege reconnaissance: The leaked timesheet data may reveal activity names, project identifiers, and internal cost structures, which can be used to map the organization’s operational footprint and guide further attacks (e.g., targeted phishing, social engineering, or lateral movement using discovered internal nomenclature).
• Data exfiltration: The attacker can script the extraction and exfiltrate the data over the same authenticated channel.

Impact at this stage: Confidentiality breach of timesheet metadata and work records across team boundaries. The attacker cannot modify or delete records (the CVSS impact on integrity and availability is NONE), limiting direct destructive impact.

Impact Assessment

Business Impact:

• Confidentiality: LOW (per CVSS subscore). The exposed data is timesheet metadata — not credentials, PII, or financial secrets in the strictest sense. However, in organizations where timesheet entries correlate with sensitive project code names, defense contracts, or premium client billing, the data leakage could be material.
• Integrity: NONE. The attacker cannot modify timesheet data through this flaw.
• Availability: NONE. The flaw does not allow denial-of-service.

Affected Systems:

• All Kimai deployments running versions prior to 2.65.0.
• Multi-team installations where activities are configured with restricted teams and where at least one role grants view_other_timesheet to users outside those teams.
• Organizations with externally exposed Kimai REST APIs (authentication via username/password or API tokens).

Blast Radius: The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates: network-exploitable, low attack complexity, requires low privileges (authenticated), no user interaction, no scope change, limited confidentiality impact. The practical blast radius is horizontal — across teams/departments in the same Kimai instance. The attack surface is constrained to authenticated users, reducing external attacker exposure unless credentials are compromised first.

EPSS Score: Not yet scored by FIRST.org. No active exploitation evidence exists at the time of writing.

Detection Guidance

Sigma Rule

title: Kimai REST API Timesheet Collection Team Isolation Bypass Attempt
id: 312a8c4e-c0e3-4f13-9b1a-7d2e7e2f8a1c
status: experimental
description: Detects suspicious enumeration of the Kimai timesheet API collection endpoint by a single user with view_other_timesheet permission across many distinct result sets, which may indicate attempts to exploit CVE-2026-84808 team isolation bypass.
author: Valters IT Security Research
date: 2026/05/18
logsource:
    category: application
    product: kimai
    definition: 'Kimai REST API access logs recording URI, user, and status code 200.'
detection:
    selection:
        request_method: GET
        uri_path|startswith: '/api/timesheets'
        response_status: 200
    filter_known:
        http_user_agent|endswith: 'Kimai-CLI'  # Adjust to whitelist legitimate API clients
    filter_baseline:
        # Baseline rule requiring tuning per deployment; this rule fires on heavy enumeration.
        response_body_length|gt: 100000
    condition: selection and not filter_known and filter_baseline
    timeframe: 5m
level: medium
tags:
    - cve.2026-84808
    - attack.t1190
    - attack.collection.t1213
falsepositives:
    - Legitimate managers/dashboard sync tools querying full timesheet sets within a 5-minute window.
    - Internal reporting scripts running during business hours.

Note: Log source availability depends on the application logging configuration — most Kimai deployments log REST API requests to server access logs (Apache/Nginx).

YARA Rule

rule Kimai_Timesheet_API_Excessive_Enumeration
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects log lines or HTTP response bodies indicating bulk enumeration of Kimai timesheet collection API — possible CVE-2026-84808 exploitation artifact."
        cve = "CVE-2026-84808"
        date = "2026-05-18"
        reference = "NVD, Kimai changelog"
        severity = "medium"
    strings:
        $api_call = "/api/timesheets" ascii wide
        $view_perm = "view_other_timesheet" ascii wide
        $pagination = "page=" ascii wide
        $per_page = "perPage=" ascii wide
        // Look for repeated requests in access log context
        $api_token = "X-AUTH-TOKEN" ascii wide nocase
        $bearer = "Authorization: Bearer" ascii wide nocase
        // Responses enumerating large JSON arrays of timesheet records
        $record_array = "\"timesheets\":[" ascii wide
        $record_array_alt = "\"items\":[" ascii wide
        $id_field = "\"id\":" ascii wide
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize > 100KB
        and (
            2 of ($api_call, $view_perm, $pagination, $per_page) 
            or ($api_call and 2 of ($record_array, $id_field))
        )
        and (any of ($api_token, $bearer))
}

Suricata IDS Rule

alert http any any -> $KIMAI_SERVERS any (msg:"KIMAI CVE-2026-84808 Attempt - Timesheet Collection API Cross-Team Enumeration"; flow:established,to_server; content:"GET"; http_method; content:"/api/timesheets"; http_uri; nocase; content:"page="; http_uri; nocase; content:"size="; http_uri; nocase; pcre:"/^\/api\/timesheets[^\r\n]*(\?|\&)(page|size|perPage)="; http_uri; threshold:type both, track by_src, count 20, seconds 60; reference:cve,2026-84808; classtype:attempted-recon; sid:202684808; rev:1;)

Rule notes: This rule fires when a single source IP issues 20+ GET requests against the timesheet collection API within 60 seconds, suggesting scripted enumeration. The $KIMAI_SERVERS variable must be defined in the Suricata config. Threshold tuning is required per deployment.

Elastic Detection

// Detection assumes HTTP access logs are ingested with fields:
// http.request.method, url.path, url.query, source.ip, user.name, http.response.status_code
sequence by source.ip, user.name with maxspan=5m
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
  [any where http.request.method == "GET" and url.path == "/api/timesheets" and http.response.status_code == 200]
| filter count == 10

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET" AND uri_path="/api/timesheets" AND status=200
| stats count as request_count, values(uri_query) as queries by clientip, user
| where request_count > 50
| eval suspicious = if(request_count > 50, "HIGH", "LOW")
| table _time, clientip, user, request_count, queries, suspicious
| sort - request_count
| `ut_parse(queries)`

Alternative (streaming, anomaly-based):

index=web sourcetype=access_combined
| bucket _time span=5m
| stats count as request_count dc(uri_path) as unique_paths by clientip, user, _time
| where request_count > 50 AND unique_paths <= 2
| eval alert = "CVE-2026-84808 - timesheet collection enumeration"

Wazuh OSSEC Rule

<group name="kimai,">
  <rule id="100201" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/timesheets</field>
    <field name="method">GET</field>
    <field name="response">200</field>
    <description>Kimai: Multiple GET requests to timesheet collection API - possible CVE-2026-84808 enumeration</description>
    <group>access_control,</group>
    <if_sid>100200</if_sid>
    <frequency>30</frequency>
    <timeframe>120</timeframe>
    <same_source_ip/>
    <options>no_full_log</options>
  </rule>
</group>

Note: The rule requires a parent rule (ID 100200) that matches each individual /api/timesheets GET request. Frequency of 30 hits within 120 seconds triggers the alert.

Mitigation & Patch Guidance

Patch Status: The CVE is UNPATCHED in all externally verified sources. Patch confidence is 0/4 — no vendor patch commit, advisory, or fix binary has been observed in any tracked channel. Version 2.65.0 is referenced in the NVD description as the fixing release, but no official changelog or release announcement confirms its availability. Do not assume 2.65.0 is publicly released — verify with the vendor directly.

Immediate Mitigations (no patch available yet):

1. Restrict view_other_timesheet permission: Audit all role assignments. Remove this permission from users who do not require cross-user timesheet visibility. This directly shrinks the attack surface — the flaw is unreachable without this permission.
2. Network-level access control: Restrict the REST API endpoint to trusted network segments or VPN-only access. If the Kimai UI must be public, place the API behind a reverse proxy and apply IP-based allow-listing where feasible.
3. API token hygiene: Rotate all API tokens and force re-authentication to invalidate potentially harvested credentials.
4. Monitoring alert: Deploy the Sigma rule or Splunk query above to detect anomalous enumeration behavior — respond manually to alerts until a patch exists.

Patch/Upgrade Steps (when vendor releases 2.65.0):

1. Subscribe to Kimai security advisories / GitHub releases to obtain official notification of the 2.65.0 release.
2. Test 2.65.0 in a staging environment replicating multi-tenant team structures. Verify that a user with view_other_timesheet cannot enumerate timesheets for activities restricted to non-member teams.
3. Schedule the upgrade during a maintenance window; back up the database and application files prior to deployment.
4. If the vendor does not release a fix within a reasonable timeframe, consider compensating controls in addition to the immediate mitigations above.

Long-term Hardening:

1. Enforce principle of least privilege: Conduct quarterly audits of role/permission assignments, focusing on view_other_timesheet and other view_other_* privileges.
2. Adopt a Web Application Firewall (WAF) with rate-limiting rules applied to API endpoints to blunt scripted enumeration.
3. Enable comprehensive API audit logging (user, timestamp, query parameters, response size) and retain logs for forensic analysis.
4. Implement an API security posture assessment to regularly scan for broken object-level authorization (BOLA) and broken function-level authorization (BFLA) flaws.
5. Feature request: Ask the vendor to enforce team-scoped filtering server-side at the repository/ORM layer as a defense-in-depth measure, independent of UI/API permission gates.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84808 (Authoritative CVE description and CVSS vector)
2. Kimai Vendor / Project: https://www.kimai.org/ (Official project site — check "Downloads/Changelog" section for 2.65.0 release status; no dedicated security advisory page exists at time of writing)
3. CWE-863 Reference: https://cwe.mitre.org/data/definitions/863.html (Incorrect Authorization — vulnerability class reference)
4. Kimai GitHub Repository (Changelog monitoring): https://github.com/Kimai/Kimai/releases (Track release 2.65.0 for the fix commit)
5. CISA Known Exploited Vulnerabilities Catalog: Not applicable — CVE-2026-84808 is NOT listed on the KEV at the time of writing.

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild activity, or dark-web chatter has been identified referencing CVE-2026-84808 at the time of writing. Exploitation likelihood is considered low-to-moderate given the requirement for an authenticated account with a specific permission. However, the flaw belongs to a class (broken access control / team isolation) that is frequently chained with credential-stuffing campaigns in SaaS and self-hosted time-tracking applications. Security teams are advised to prioritize log monitoring for suspicious API enumeration regardless of current threat intel, as proof-of-concept code may emerge following public patch release.