SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-84805

MEDIUM · CVSS 4.3 EPSS 0.21% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-02 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Versions of Kimai from 2.61.0 to before 2.63.0 are vulnerable due to insufficient permission checks in the PATCH /api/users/{id}/preferences endpoint, allowing low-privilege users to modify admin-only work-contract preferences. This could lead to unauthorized changes to sensitive employment contract data, potentially compromising the integrity of user contracts. Organizations using affected versions should prioritize upgrading to 2.63.0 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-84805
Severity
MEDIUM
CVSS
4.3
EPSS
0.21%

Original NVD Description

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.