CyberRota Analysis
AI-GeneratedKimai versions prior to 2.62.0 are vulnerable due to inadequate validation of permissions in the QuickEntry controller, allowing authenticated users with specific permissions to create timesheets for other team members without proper authorization checks. This flaw could lead to unauthorized time tracking and reporting, potentially impacting project management and resource allocation. Organizations using Kimai should prioritize patching this vulnerability to prevent exploitation by malicious insiders.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.