Threats tagged 'ghsa-4m8q-55qv-9pwp'

Kimai versions prior to 2.57.0 contain an authorization bypass vulnerability in the GET /api/timesheets endpoint. A user with the ROLE_TEAMLEAD and the view_other_timesheet permission can retrieve timesheet records of other users without being the teamlead of the target user's team. This bypass occurs because the list endpoint does not enforce the teamlead check that the per-record endpoint enforces. As a result, sensitive financial data such as rate and internalRate, along with personal activity details, can be disclosed to unauthorized teamlead users.