Executive brief
Kimai, an open-source time-tracking application, contains a flaw that allows users to continue logging time against projects even after their access has been revoked. By using the 'restart' or 'duplicate' features on their historical entries, users can bypass administrative restrictions. This can lead to inaccurate project billing, budget pollution, and unauthorized data entry in corporate invoicing workflows.
Technical details
An improper authorization vulnerability exists in Kimai's `restart` and `duplicate` workflows (specifically `PATCH /api/timesheets/{id}/restart` and `PATCH /api/timesheets/{id}/duplicate`). The root cause is located in `src/Voter/TimesheetVoter.php`, where the logic grants access based on the user's ownership of a historical record before verifying current team-based project permissions. An authenticated attacker can use an old timesheet entry as a 'capability token' to persist new records to the database for a revoked project. The fix, introduced in version 2.58.0, updates `TimesheetVoter::canStart()` to enforce team-access checks for both projects and activities during duplication and restart flows.
Affected products
- Kimai Kimai <= 2.57.0
Timeline
- 2026-06-11: disclosed
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 2.58.0 released