Threats tagged 'ghsa-vrr2-g9gh-c3jc'

Kimai versions prior to 2.57.0 have a vulnerability in the Timesheet API PATCH and POST endpoints that allows authenticated users to assign their timesheets to projects outside their authorized teams. This occurs because the project ID submitted by the user bypasses team membership checks due to an unconditional OR condition in the query builder. Consequently, users can access project and customer metadata that should be restricted by team access controls.