CVE-2026-84806

Katalog CVE

CVSS 5.4 · Medium EPSS 0,24%

Kerentanan Incorrect Permission Assignment for Critical Resource. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

2 September 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/kimai/kimai/security/advisories/GHSA-gmm9-hfxg-7v29
• https://www.vulncheck.com/advisories/kimai-before-2.63.0-authorization-bypass-via-team-access-endpoints