Description
Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kimai kimai
< 2.57.0affected
References
- https://github.com/kimai/kimai/security/advisories/GHSA-vrr2-g9gh-c3jc ↗
- https://github.com/kimai/kimai/pull/5929 ↗
- https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849 ↗
- https://github.com/kimai/kimai/releases/tag/2.57.0 ↗
- https://www.kimai.org/en/security/ghsa-vrr2-g9gh-c3jc ↗