Description
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kimai | kimai | < 2.62.0 | 2.62.0 |
References
- GitHub Security Advisory (GHSA-2w7f-x78f-89q2) vendor-advisory
- VulnCheck Advisory: Kimai before 2.62.0 Authorization Bypass via QuickEntry third-party-advisory