The vulnerability in Kimai's Timesheet API PATCH /api/timesheets/{id} and POST /api/timesheets endpoints arises from improper access control validation on the project field. The access control voter only verifies ownership of the timesheet but does not validate the new project assignment. The form handling code uses a Symfony EntityType with a query builder that includes an unconditional OR clause allowing any submitted project ID to bypass team membership restrictions. This enables any authenticated user to reassign their timesheet to any project in the database, including those outside their teams, and retrieve sensitive project and customer metadata via the API.

An authenticated user with permission to edit their own timesheets can reassign timesheets to projects outside their authorized teams. This leads to unauthorized disclosure of project and customer metadata such as names, currency, and customer hierarchy that would normally be filtered by team ACLs. There is no indication of remote code execution or privilege escalation beyond this unauthorized data access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Timesheet API endpoints to trusted users only and monitor for suspicious timesheet project reassignments. Avoid exposing detailed project/customer metadata in API responses to unauthorized users. Follow vendor updates for an official fix.