CyberRota Analysis
AI-GeneratedKimai versions prior to 2.56.0 are vulnerable due to insufficient team-membership checks in the TimesheetVoter::voteOnAttribute() function, allowing authenticated users with the ROLE_TEAMLEAD or similar roles to access, modify, and delete any user's timesheets through the API. This flaw poses a significant risk as it enables unauthorized data manipulation across the system, affecting all users. Organizations utilizing Kimai, especially those with team lead roles, should prioritize applying the update to mitigate potential data breaches and maintain compliance.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)