Packagist · kimai/kimai
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This allows cross-user manipulation of per-user favorite state without administrative privileges.
The issue affects the following routes:
GET /en/favorite/timesheet/add/{id}GET /en/favorite/timesheet/remove/{id}Both endpoints accept a user-controlled timesheet identifier and only require the caller to hold the generic start_own_timesheet permission. They do not verify that the referenced Timesheet object belongs to the currently authenticated user.
src/Controller/FavoriteController.php, the controller methods accept a Timesheet object directly and forward it to the favorite service. src/Timesheet/FavoriteRecordService.php. The bookmark owner is derived from $timesheet->getUser() instead of the current session user.favorite/recent bookmark data.A PoC was provided, but removed for security reasons.
This vulnerability allows any authenticated low-privileged user to manipulate another user's favorite bookmark state across accounts. An attacker can inject arbitrary victim-owned timesheet entries into the victim's quick-entry workflow, remove existing favorites, and repeatedly disturb the victim's normal timesheet usage without needing administrative privileges.
The issue does not directly disclose sensitive data, but it is a real cross-user business-state tampering vulnerability with clear integrity impact. Because the add and remove endpoints can be combined, an attacker can reliably insert, remove, and reorder entries in another user's favorite/recent list.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.