Description
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
Published: 2026-09-02
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The flaw allows authenticated users without administrative privileges to alter work‑contract preferences that should only be set by administrators. Through the PATCH /api/users/{id}/preferences endpoint, a regular user can change the admin‑only work‑contract data, potentially misrepresenting time entries or contractual terms. This constitutes a system authorization error (CWE-862) and enables unauthorized data manipulation.

Affected Systems

Kimai, versions 2.61.0 through 2.62.x. The vulnerability exists in the Kimai API used for user preferences and is fixed in release 2.63.0.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attackers need only an authenticated session to call the PATCH endpoint; no additional privileges are required, making the vulnerability straightforward to exploit for any logged‑in user.

Generated by OpenCVE AI on September 2, 2026 at 12:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Kimai to version 2.63.0 or later to enforce the admin‑only permission check on the API.
  • If an immediate upgrade is not possible, restrict API access for non‑admin users or add custom middleware to enforce the permission check before processing the PATCH request.
  • Regularly audit API logs for PATCH /api/users/{id}/preferences calls and investigate any unauthorized changes to work‑contract preferences.

Generated by OpenCVE AI on September 2, 2026 at 12:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
Title Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
First Time appeared Kimai
Kimai kimai
Weaknesses CWE-862
CPEs cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*
Vendors & Products Kimai
Kimai kimai
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Kimai Kimai
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-02T13:11:21.797Z

Reserved: 2026-09-02T10:19:32.991Z

Link: CVE-2026-84805

cve-icon Vulnrichment

Updated: 2026-09-02T13:11:17.471Z

cve-icon NVD

Status : Deferred

Published: 2026-09-02T12:17:17.457

Modified: 2026-09-02T14:17:17.583

Link: CVE-2026-84805

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T13:00:13Z

Weaknesses