Kimai versions prior to 2.58.0 have a CSRF vulnerability in the timesheet API where the stop and restart operations are accessible via GET requests that modify business state. Since these endpoints reuse the browser's existing session and do not require additional user interaction, an attacker can cause unauthorized state changes by tricking an authenticated user into visiting a malicious page. The vulnerability affects the GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart routes. The fix involves removing these GET routes and restricting the operations to PATCH methods only.

An attacker can cause unauthorized changes to timesheet states for authenticated users without their consent. This can stop active timesheets or restart historical ones, leading to corrupted time records, inaccurate billing, distorted reporting, and interference with approval or audit processes. The attack requires only that the victim be logged in and visit a malicious page, making the attack vector low barrier. There are persistent side effects on the database and business logic integrity.

The vulnerability is addressed by removing the GET routes for stop and restart operations and allowing these actions only via PATCH requests. Users should upgrade to Kimai version 2.58.0 or later where this fix is implemented. No additional mitigations are specified by the vendor advisory.