Kimai versions prior to 2.58.0 have an authenticated authorization bypass in the timesheet restart and duplicate features. The vulnerability arises because the authorization logic prioritizes ownership of historical timesheets over current team-based access controls. Specifically, the restart and duplicate workflows copy project and activity data from old timesheets without verifying if the user still has access to those projects or activities. This allows users to create new timesheets under projects they no longer have permission to access. The root cause is that the authorization check in TimesheetVoter.php evaluates the user's ownership of the timesheet before checking team access, and the restart/duplicate capability only verifies object visibility, not current access rights. The issue affects PATCH API endpoints and the web UI, resulting in persistent unauthorized write access after project access revocation. The fix involves updating TimesheetVoter::canStart() to check team access for project and activity in all relevant workflows.

Users who have had their access to a project revoked can still create new time entries for that project by restarting or duplicating old timesheets. This bypasses administrative access control changes and can lead to inaccurate project time tracking, budget calculations, statistics, reports, and invoicing. The vulnerability allows persistent unauthorized writes to the database, not just UI inconsistencies or caching issues. It undermines the integrity of project data and administrative controls.

A fix is available in Kimai version 2.58.0 and later. The update modifies the authorization logic to verify team-based access to projects and activities during timesheet restart and duplicate operations. Users and administrators should upgrade to version 2.58.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory at https://www.kimai.org/en/security/ghsa-c6w6-57jj-62vh. No alternative mitigations are indicated.