Kimai versions prior to 2.56.0 have a permission model issue where users with the ROLE_TEAMLEAD can enumerate, read, modify, and delete timesheets of any user across all teams. This occurs because the system does not enforce team membership checks for these permissions, allowing cross-team timesheet manipulation. The behavior is by design according to Kimai's documented permissions but may be unexpected. The issue is fixed in version 2.56.0 with added team-scoped permission checks.