Timesheet lists ignored team restrictions on activities

Affected versions

Kimai versions <= 2.64.0 are affected by this security issue
The issue has been fixed in Kimai 2.65.0
Severity: Low
A CVE ID is requested, pending assignment

Description

When you restrict an activity to certain teams, Kimai did not apply that restriction to timesheet lists. Users who are allowed to see other people’s timesheets — team leads by default — could see recorded times for activities that belong to teams they are not a member of.

Team restrictions on customers and projects were applied correctly, only team restrictions defined on an activity were ignored.
The affected user needs the view_other_timesheets permission, which the team lead role has by default.
Single timesheet views and the GET /api/timesheets/{id} endpoint did enforce the activity restriction and returned “403 Forbidden”.
The incomplete filter was shared by many timesheet queries and affected the timesheet listing, the calendar, timesheet exports, the GET /api/timesheets endpoint and the “recent activities” list.
Visible information was limited to timesheet metadata. The issue did not allow creating, changing or deleting records.
Only installations were affected which used team restrictions on activities.

Solution

The shared permission filter for timesheet queries now also checks the teams assigned to the activity, so lists return the same records that a single timesheet view would allow.

Users should update to 2.65.0 or newer.

Credits

Reported by: Rajib-Mahmud
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-c6j4-35fc-x3hw