4 matches found
CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...
CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...
CVE-2026-84805
Kimai versions 2.61.0 through 2.62.x contain an authorization bypass in the PATCH /api/users/{id}/preferences API endpoint. The WorkContractPreferenceSubscriber, introduced in 2.61.0, registers admin-only work-contract preferences as enabled without verifying the contract_other_profile permission...
EUVD-2026-69917
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...