Users could move their time records into projects of other teams

Affected versions

Kimai versions < 2.68.0 are affected by this security issue
The issue has been fixed in Kimai 2.68.0
Severity: Medium
A CVE ID is requested, pending assignment

Description

A regular user could move their own time records into a project of a team they don’t belong to. The hours then appeared in that team’s budget, reports, and invoices, even though the user had no access to the project.

Any user who can edit their own time records could do this, which every user can do by default
The problem was in the “Edit multiple entries” (batch update) feature of the timesheet list
The single-edit form and the API already blocked this correctly
Users could only move their own time records, they could not see the other team’s data or change time records of other users
Affected teams could see wrong numbers in project budgets, statistics, reports, and invoices

Solution

The batch update now checks if the user has access to the chosen project and activity, in the same way as the single-edit form. The batch update is also denied completely if it contains a single time record the user isn’t allowed to edit.

Users should update to 2.68.0 or newer.

Credits

Reported by: svo.com.br
Patched by: kevinpapst