Executive brief
Kimai, a popular open-source time-tracking application, contains a security flaw that allows users with 'Teamlead' roles to view the timesheets of any other user in the system. This bypasses intended privacy controls, potentially exposing sensitive activity logs and financial billing rates for employees outside of the teamlead's authorized scope. An exploit could lead to the unauthorized disclosure of personal activity data and corporate financial information.
Technical details
An authorization mismatch exists between the per-record voter and the collection endpoint in Kimai's API. While the `GET /api/timesheets/{id}` endpoint correctly enforces teamlead-of-target checks via `TimesheetVoter`, the list endpoint `GET /api/timesheets` only checks for the global `view_other_timesheet` permission, which is granted to all teamleads. An attacker with `ROLE_TEAMLEAD` can use the `user` or `users[]` query parameters to retrieve records for any user, provided the records are on projects without team scoping or projects where the attacker is a member. This leaks sensitive fields including `rate`, `internalRate`, and activity descriptions. The issue is fixed in version 2.57.0 by introducing the `access_user` permission check in `TimesheetController::cgetAction()`.
Affected products
- Kimai Kimai <= 2.56.0
Timeline
- 2026-06-11: disclosed: Initial disclosure to vendor
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-13: patched: Fix released in version 2.57.0