CVE-2026-84808

MediumCVSS 4.3/10Last modified Sep 2, 2026

Description

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-848096.5Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories an CVE-2026-84819.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /CVE-2026-848106.5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python CVE-2026-848116.5agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan CVE-2026-848127.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.CVE-2026-848139.3Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-848149.8Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.CVE-2026-848155.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. T CVE-2026-848167.1Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.CVE-2026-848177.1Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.CVE-2026-848187.1Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.CVE-2026-848197.1Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.