Kimai
Team leads could add time records for their team members without the required permission
Affected versions
- Kimai versions <= 2.61.0 are affected by this security issue
- The issue has been fixed in Kimai 2.62.0
- Severity: Medium
- We have not requested an official CVE ID for this security advisory
Description
The weekly times screen didn’t check whether you’re allowed to create time records for other people before saving them. A team lead who was meant to only view and correct their team members’ times could also add new entries in their name.
- Only the weekly times screen (QuickEntry) was affected. The API and the regular timesheet screens always performed the check.
- Installations using the default roles are not affected. The standard team lead role includes the permission to create time records for other users, so no boundary was crossed there.
- The issue only shows up in installations with a custom role that grants “view” and “edit” for other users’ timesheets, but explicitly denies “create”. That’s a valid setup for someone who may correct their team’s times but must not book new ones.
- The affected accounts are limited to the members of teams you lead. The user selection on that screen never offered other accounts.
Why we didn’t request a CVE
The release was published before the Github advisory was received.
| date | event |
|---|---|
| 2026-06-17 | 2.61.0 released - affected |
| 2026-06-30 | fix merged (#6029, “improve handling of create_other_timesheet permission”) |
| 2026-07-09 | 2.62.0 released - fixed |
| 2026-07-25 | 2.63.0 released |
| 2026-07-30 | Github advisory |
Solution
Kimai 2.62.0 added the missing permission check to the weekly times screen: days you’re not allowed to book for someone else are now shown as read-only, and any value submitted for them is discarded.
Users should update to 2.62.0 or newer.
Credits
- Reported by: kevinpapst
- Patched by: kevinpapst
First reported in GitHub advisory: GHSA-2w7f-x78f-89q2