Description
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kimai | kimai | < 2.65.0 | 2.65.0 |
References
- GitHub Security Advisory (GHSA-c6j4-35fc-x3hw) vendor-advisory
- VulnCheck Advisory: Kimai before 2.65.0 Authorization Bypass via API Timesheet third-party-advisory