Description

Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-26T05:18:26.617Z",
  "pubdate": "2026-08-26T05:18:26.617Z",
  "executiveSummary": "A broken access control vulnerability exists in Kimai prior to version 2.62.0, specifically within the QuickEntry controller.\nThe vulnerability allows an authenticated user to perform unauthorized timesheet creation for other team members by leveraging insufficient permission validation.\nAlthough the application enforces authorization checks in other areas, the QuickEntry feature fails to verify the 'create_other_timesheet' permission during the submission process.\nAn attacker possessing 'view_other_timesheet' and 'edit_other_timesheet' privileges can manipulate the QuickEntry form to inject timesheet records on behalf of other users.\nThe impact includes potential data integrity loss, unauthorized payroll or project tracking manipulation, and circumvention of organizational reporting workflows.\nExploitation requires an authenticated session with specific, albeit lower, administrative permissions, making this a privilege escalation issue within the timesheet management system.",
  "technicalDetails": "The vulnerability resides within the QuickEntry controller of Kimai, which serves as a specialized interface for rapid timesheet submission. The root cause is a failure to perform a strict authorization check against the 'create_other_timesheet' permission when processing incoming form data.\nIn the affected versions prior to 2.62.0, the QuickEntry controller logic relies on an incomplete access control implementation. While the system correctly validates permissions for standard timesheet entry routes, the QuickEntry route fails to verify if the actor has the necessary authorization to create entries for users other than themselves.\nThe attack flow begins with an authenticated attacker, who must possess 'view_other_timesheet' and 'edit_other_timesheet' privileges. By submitting a specially crafted HTTP request to the QuickEntry endpoint, the attacker can specify a target user ID or account context that they are not authorized to modify. Because the application logic does not re-validate the 'create_other_timesheet' permission at the controller level during the QuickEntry POST request, the application proceeds to persist the timesheet record in the database as if the action were authorized.\nThe component responsible for this flaw is the QuickEntry controller's handling of user-submitted record creation requests. The failure to enforce a server-side permission check allows for the circumvention of business rules intended to isolate timesheet creation capabilities. By effectively bypassing the authorization layer, an attacker can impact project cost tracking, billing accuracy, and team member productivity metrics. Since the application already permits the attacker to view and edit existing timesheets, the gap in the 'create' permission represents a logical inconsistency in the access control matrix. No memory corruption or binary exploitation is required; the vulnerability is purely logical and executed through legitimate application protocols and API/form interactions."
}