Kimai versions prior to 2.57.0 have an improper authorization (IDOR) vulnerability in the endpoints GET /en/favorite/timesheet/add/{id} and GET /en/favorite/timesheet/remove/{id}. These endpoints accept a timesheet ID and require only the 'start_own_timesheet' permission but do not verify ownership of the timesheet by the authenticated user. The controller forwards the timesheet object to the favorite service, which derives the bookmark owner from the timesheet's user rather than the session user. This design flaw enables any authenticated user to manipulate another user's favorite/recent bookmark list by adding or removing victim-owned timesheets, causing cross-user business-state tampering without needing admin privileges.

An authenticated low-privileged attacker can manipulate the favorite bookmark state of other users by adding or removing victim-owned timesheet entries. This can disrupt the victim's normal workflow by injecting or removing quick-entry favorites, impacting the integrity of user-specific business data. The vulnerability does not disclose sensitive data but allows reliable cross-user tampering of per-user favorite lists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints to trusted users only or monitor for unusual favorite list modifications. Avoid sharing timesheet IDs publicly to reduce risk. Follow vendor updates for an official fix in versions 2.57.0 or later.