Executive brief
Kimai is a time-tracking application used to record and manage employee work hours. A flaw in its permission system allows any team lead user to view, modify, and permanently delete timesheets belonging to any employee across the entire system—including those on different teams or with no team affiliation. An attacker with team lead privileges can tamper with billable hours, delete payroll records, and forge timesheet data affecting invoicing and compensation.
Technical details
The vulnerability is a missing authorization check in TimesheetVoter::voteOnAttribute() (CWE-863: Incorrect Authorization). The voter maps permissions only to `own_timesheet` or `other_timesheet` without validating team membership, allowing ROLE_TEAMLEAD users to access any timesheet via the API regardless of team affiliation. Attack surface is network-accessible (API endpoints), no special privileges or interaction required beyond authentication. Affected accounts with edit_other_timesheet or delete_other_timesheet permissions can enumerate sequential timesheet IDs and perform read, modify, or delete operations on all timesheets system-wide. The vulnerability was patched in version 2.56.0 by adding team-scoped permission checks.
Affected products
- Kimai Kimai before 2.56.0
Timeline
- 2026-04-27: disclosed: GitHub security advisory GHSA-9g2q-w3w2-vf7q published
- 2026-04-27: patched: Fix released in version 2.56.0