CVE-2026-80202

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.56.0

Description An issue exists where team-membership checks are not enforced in the voteOnAttribute() function of TimesheetVoter. This function maps permissions only to own timesheet or other timesheet. Consequently, any authenticated user with ROLE TEAMLEAD or a role possessing edit other timesheet or delete other timesheet permissions can read, modify, and permanently delete timesheets of any user across the entire system via the API, regardless of whether they belong to the same team. This is facilitated by the fact that timesheet IDs are sequential integers and easily enumerable.

Recommendations Update to version 2.56.0 or later.