EUVD-2026-69920

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

CVE-2026-84808

Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...

CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...