Is CVE-2026-84804 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84804?

CVE-2026-84804 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-84804

Description

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.