Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. (CVE-2026-80193)

Kimai prior to version 2.62.0 does not properly validate the create_other_timesheet permission in its QuickEntry controller. This flaw allows authenticated users with view_other_timesheet and edit_other_timesheet permissions to create timesheet entries on behalf of other users without proper authorization enforcement. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. There are no known exploits in the wild and no explicit patch links provided in the data.

Exploitation of this vulnerability allows an authenticated user with certain permissions to create timesheet records for other users without proper authorization. This can lead to unauthorized data modification and potential disruption of timesheet integrity, impacting confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided, users should monitor official Kimai channels for updates. Until a fix is available, restrict permissions carefully to minimize risk, ensuring only trusted users have view_other_timesheet and edit_other_timesheet permissions.