CVE-2026-80202

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD (or a role holding editothertimesheet/deleteothertimesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLEUSER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)