Security Advisory
CVE-2026-84804
5.4
MEDIUM
Vulnerability Description
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
Published Date
September 2, 2026
Official Source
NIST NVD Advisory