Threats tagged 'ghsa-c6w6-57jj-62vh'

Kimai 2.56.0 and earlier contain an authorization bypass vulnerability in the timesheet restart and duplicate workflows. After a user loses access to a project, they can still create new timesheets under that project by restarting or duplicating historical entries. This occurs because the authorization logic trusts ownership of old timesheets more than current project access rights, allowing persistent write access despite revocation. The issue affects API endpoints and the web UI flows that reuse historical project and activity bindings. This can lead to unauthorized time entries that undermine access control and affect project tracking and reporting.