Description

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T12:17:17.870Z",
  "pubdate": "2026-09-02T12:17:17.870Z",
  "executiveSummary": "Kimai versions prior to 2.65.0 are affected by an authorization bypass vulnerability within the REST API timesheet collection endpoint.\nThe vulnerability stems from improper enforcement of team-based access control policies when retrieving timesheet data associated with specific activities.\nAn authenticated user possessing the 'view_other_timesheet' permission can exploit this flaw to enumerate and access timesheet entries linked to activities restricted to teams of which they are not a member.\nThis failure in data isolation leads to an unauthorized information disclosure of sensitive project tracking data.\nThe impact is significant for organizations relying on team-level segregation to maintain project confidentiality, as it allows unauthorized users to view proprietary labor records across the entire installation.\nExploitation requires a valid user account with the aforementioned permission but does not require administrative privileges, making it a risk for any environment with multi-team configurations.",
  "technicalDetails": "The vulnerability resides in the Kimai REST API implementation, specifically within the logic governing the timesheet collection endpoint. The root cause is a deficiency in the authorization middleware or controller logic that fails to cross-reference the activity-team relationship during a request to list timesheet resources.\nWhen a user performs a GET request to the timesheet collection endpoint, the application correctly verifies the 'view_other_timesheet' permission. However, the system fails to apply a secondary security filter to validate if the authenticated user possesses the necessary organizational or team association to view entries linked to specific activities.\nThe attack flow proceeds as follows: 1. An authenticated attacker identifies a valid endpoint for timesheet collection (e.g., /api/timesheets). 2. The attacker crafts a request to the endpoint. 3. The server validates the attacker's global 'view_other_timesheet' permission, which is granted. 4. Due to the missing granular access check, the application retrieves all timesheets from the database that match the provided filtering criteria without filtering by the attacker's team membership. 5. The application returns sensitive timesheet data for activities and teams the attacker should not have visibility into. 6. The attacker harvests this unauthorized data to profile team activities or access private project logs.\nThis flaw effectively negates the intended data isolation boundary implemented by Kimai's team-based access control. The vulnerable component is the API controller responsible for handling RESTful requests for timesheets. By neglecting to enforce team constraints, the API allows for the leakage of restricted data globally across the application scope.\nThe vulnerability is present in all versions prior to 2.65.0. Authentication is required to exploit this flaw, but since the requirement is a standard 'view_other_timesheet' permission, the barrier to entry for internal malicious actors or compromised accounts is low. The network exposure is limited to the web server hosting the Kimai REST API, typically over HTTPS.\nThe post-exploitation impact includes the systematic exposure of confidential project tracking information, potential mapping of organizational structure and resource allocation, and the erosion of internal security controls regarding data privacy."
}