EUVD-2026-69916
GHSA-xcvc-fv83-5g8g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires authenticated low-privilege account (PR:L); no confidentiality impact; integrity and availability both low as only team-resource linkages can be severed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
AnalysisAI
Authorization bypass in Kimai before 2.65.0 allows authenticated users holding the edit_team permission to revoke team access to activities, projects, and customers via API endpoints without passing the required permissions_activity check. This breaks Kimai's intended multi-layered permission model, enabling a lower-privileged operator to sever team-level associations to sensitive time-tracking resources they are not authorized to modify. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Kimai account with the edit_team permission explicitly granted - anonymous users and accounts without this role cannot exploit the flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a remotely exploitable flaw requiring only a valid low-privilege account and no additional conditions, which is accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2.65.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover in Kimai time-tracking software (versions <= 2.57.0) stems from the official Docker image shipping a pu
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated crit
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today