CVE-2026-52819

Summary

Details

Per-record path (correct)

if (!$this->permissionManager->checkTeamAccessTimesheet($subject, $user)) {
  return false;
}
return $this->permissionManager->hasRolePermission($user, $permission . ' other timesheet');

"a TEAMLEAD role with view other timesheet must not access another user's timesheet by being a plain team member — they must be the team's teamlead."

List path (vulnerable)

public function cgetAction(ParamFetcherInterface $paramFetcher, ..., UserRepository $userRepository): Response
{
  $query = new TimesheetQuery(false);
  $this->prepareQuery($query, $paramFetcher);
  $seeAll = false;

  if ($this->isGranted('view other timesheet')) {
    /** @var array<int> $users */
    $users = $paramFetcher->get('users');
    $userId = $paramFetcher->get('user');

    if ('all' === $userId) {
      $seeAll = true;
    } elseif (is string($userId) && $userId !== '') {
      $users[] = (int) $userId;
    }

    if (!$seeAll) {
      foreach ($userRepository->findByIds($users) as $user) {
        $query->addUser($user);  // <-- no teamlead-of-target check
      }
    }
  }
  ...

Net effect

• has at least one team that the requester alice is not teamlead of (so the voter denies per-record access), AND
• has timesheets either on a project with no team (Kimai's default), or on a project that shares any team with alice (membership, not lead)

Why other proposed mitigations don't apply

• The view other timesheet IsGranted on the route is the only authorization layer in the list path; ROLE TEAMLEAD has it globally.
• prepareQuery only sets currentUser, not authorization (BaseApiController.php:68-71).
• The serializer does not filter rate per caller — it is a static Default-group property.
• Recent commit 20c7b03 "Re-usable ACL checks on teams" hardened the voter side but left the list endpoint unchanged.

Impact

• Authorization bypass: a ROLE TEAMLEAD (a non-admin role typically granted to multiple users in a Kimai instance) can read any other user's timesheet records
• Financial data disclosure: the rate and internalRate fields are returned in the collection serializer group, leaking what gets billed/costed against any user's records.
• PII / activity disclosure: per-entry description, begin, end, duration, billable, exported, project/activity/customer IDs, and tags are leaked, allowing reconstruction of any user's activity timeline.

Solution