Project overview export could be downloaded without reporting permission

Affected versions

Kimai versions <= 2.61.0 are affected by this security issue
The issue has been fixed in Kimai 2.64.0
Severity: Low
We have not requested an official CVE ID for this security advisory

Description

The export function of the “Project overview” report was missing a permission check. Any logged-in user could download the report as a spreadsheet, even when they weren’t allowed to open the report itself.

Any authenticated account could trigger the export, including users with only the default permissions and no project reporting permission.
The report page itself behaved correctly and denied access. Only the separate export route was unprotected.
The downloaded file listed one row per project across all customers, including customer name, project name, currency, budget type, and aggregated time totals.
Financial values stayed protected. Budget amounts, revenue, and hourly rates are rendered only for users who hold the matching budget permissions, and they were missing from the file for unprivileged users.

Solution

The permission checks were moved from the single report action to the controller itself, so they now cover the report and its export in the same way. This matches how all other reporting controllers with an export route are set up.

Users should update to 2.64.0 or newer.

Credits

Reported by: devzephyr
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-pvc4-crg3-gj44