Is CVE-2026-84808 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84808?

CVE-2026-84808 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-84808

Description

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.