PT-2026-57597 · Packagist · Kimai/Kimai

Published

2026-07-02

·

Updated

2026-07-02

CVSS v4.0

1.3

Low

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Summary

Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This allows cross-user manipulation of per-user favorite state without administrative privileges.

Details

The issue affects the following routes:
  • GET /en/favorite/timesheet/add/{id}
  • GET /en/favorite/timesheet/remove/{id}
Both endpoints accept a user-controlled timesheet identifier and only require the caller to hold the generic start own timesheet permission. They do not verify that the referenced Timesheet object belongs to the currently authenticated user.
  • In src/Controller/FavoriteController.php, the controller methods accept a Timesheet object directly and forward it to the favorite service.
  • The root cause becomes more obvious in src/Timesheet/FavoriteRecordService.php. The bookmark owner is derived from $timesheet->getUser() instead of the current session user.
  • Because of this design, any authenticated user who can reference another user's timesheet ID can modify the victim's favorite/recent bookmark data.
A PoC was provided, but removed for security reasons.

Impact

This vulnerability allows any authenticated low-privileged user to manipulate another user's favorite bookmark state across accounts. An attacker can inject arbitrary victim-owned timesheet entries into the victim's quick-entry workflow, remove existing favorites, and repeatedly disturb the victim's normal timesheet usage without needing administrative privileges.
The issue does not directly disclose sensitive data, but it is a real cross-user business-state tampering vulnerability with clear integrity impact. Because the add and remove endpoints can be combined, an attacker can reliably insert, remove, and reorder entries in another user's favorite/recent list.

Fix

Missing Authorization

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862CWE-639

Related Identifiers

GHSA-J5MC-P8QG-39J7

Affected Products

Kimai/Kimai