CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API
An authenticated user can delete all team members via a malformed API request, bypassing protections and disrupting team-based access control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-80195?
CVE-2026-80195 is a high-severity vulnerability in kimai, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.
Weakness: CWE-841
Which versions are affected by CVE-2026-80195?
How do I fix CVE-2026-80195?
No fix has been published for CVE-2026-80195 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-80195 being exploited?
There is no known exploitation of CVE-2026-80195 in the wild and no public exploit code.
Sources
Also known as GHSA-6rxf-4hh9-pp46, GHSA-fcv9-h6ph-8mrc.