CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users of Kimai versions prior to 2.57.0 to manipulate other users' favorite timesheet entries through improper authorization in the add and remove endpoints. This can lead to unauthorized changes in users' bookmarks, facilitating cross-user business-state tampering without needing administrative privileges. Organizations using Kimai should prioritize patching this vulnerability to protect against potential misuse of user data and maintain the integrity of their timesheet management.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.