The vulnerability arises from an authorization mismatch between the per-record timesheet access control and the list endpoint in Kimai. While the per-record endpoint correctly verifies that a requester with view_other_timesheet permission is the teamlead of the target user's team, the list endpoint (GET /api/timesheets?user=<id>) fails to enforce this check. Instead, it only filters projects/customers by team membership, allowing any teamlead with the permission to enumerate timesheets of users they are not teamlead of, provided the timesheets belong to projects with no team scoping or shared teams where the requester is a member but not a lead. This leads to unauthorized disclosure of timesheet records including financial rates and personal activity data. The issue affects Kimai versions before 2.57.0. The fix involves adding an access_user permission check to the list endpoint to ensure the requester is authorized to view each requested user's data.

A user with the ROLE_TEAMLEAD role and the view_other_timesheet permission can bypass intended authorization controls to access other users' timesheet records without being their teamlead. This results in unauthorized disclosure of sensitive financial information (rate, internalRate) and personally identifiable information related to user activities (descriptions, timestamps, durations, billable status, tags, and project/customer associations). This exposure can lead to privacy violations and potential misuse of financial data within organizations using Kimai.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The disclosed solution involves enforcing the access_user permission on the GET /api/timesheets list endpoint, which verifies that the requesting user is authorized to view each requested user's timesheet data. Until an official fix is applied, restrict ROLE_TEAMLEAD users' permissions or avoid using the vulnerable list endpoint with user parameters to prevent unauthorized data access.