CVE-2026-52820

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.

Summary

The Timesheet API PATCH /api/timesheets/{id} and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query_builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any authenticated user can re-assign their own timesheet to any project in the database — including projects that belong to teams or customers they have no membership in and cannot otherwise see. The user can then read serialized project/customer details via GET /api/timesheets/{id}?full=true, leaking metadata (name, currency, customer hierarchy) that would otherwise be filtered out by the team ACL.

Details

Entry point — only ownership is checked in src/API/TimesheetController.php:317-355

#[IsGranted('edit', 'timesheet')]
#[Route(methods: ['PATCH'], path: '/{id}', name: 'patch_timesheet', requirements: ['id' => '\d+'])]
public function patchAction(Request $request, Timesheet $timesheet): Response
{
    ...
    $form = $this->createForm(TimesheetApiEditForm::class, $timesheet, [...]);
    $form->setData($timesheet);
    $form->submit($request->request->all(), false);
    if (false === $form->isValid()) { ... }
    $this->service->saveTimesheet($timesheet);
    ...
}

src/Voter/TimesheetVoter.php:134-142:

if ($subject->getUser()?->getId() === $user->getId()) {
    return $this->permissionManager->hasRolePermission($user, $permission . '_own_timesheet');
}

if (!$this->permissionManager->checkTeamAccessTimesheet($subject, $user)) {
    return false;
}

For an own-timesheet, only edit_own_timesheet is required. The voter does not look at the new project being submitted; it only validates the existing record's ownership.

Form replays user-controlled project ID into the access query

src/Form/TimesheetEditForm.php:60-71:

$isNew = true;
if (isset($options['data']) && $options['data'] instanceof Timesheet) {
    ...
    if (null !== $entry->getId()) {
        $isNew = false;
    }
    ...
}
$this->addProject($builder, $isNew, $project, $customer);

src/Form/FormTrait.php:59-100:

$builder->addEventListener(
    FormEvents::PRE_SUBMIT,
    function (FormEvent $event) use ($builder, $project, $customer, $isNew, $options): void {
        $data = $event->getData();
        $customer = \array_key_exists('customer', $data) && $data['customer'] !== '' ? $data['customer'] : null;
        $project = \array_key_exists('project', $data) && $data['project'] !== '' ? $data['project'] : $project;

        $event->getForm()->add('project', ProjectType::class, array_merge($options, [
            'group_by' => null,
            'query_builder' => function (ProjectRepository $repo) use ($builder, $project, $customer, $isNew) {
                $project = \is_string($project) ? (int) $project : $project;
                ...
                if ($isNew && \is_int($project)) {
                    $project = $repo->find($project);
                    if ($project !== null) {
                        if (!$project->getCustomer()->isVisible()) { ... $project = null; }
                        elseif (!$project->isVisible())            { $project = null; }
                    }
                }
                ...
                $query = new ProjectFormTypeQuery($project, $customer);
                $query->setUser($builder->getOption('user'));
                $query->setWithCustomer(true);
                return $repo->getQueryBuilderForFormType($query);
            },
        ]));
    }
);

Two problems compound:

1. The visibility re-check on line 73 is gated on $isNew. For PATCH, $isNew = false, so the closure passes the attacker-supplied ID straight through.
2. Even when $isNew = true (POST), the re-check only validates isVisible() — it does not validate team membership.

The query-builder unconditionally accepts the submitted ID

…

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.

Summary

The Timesheet API PATCH /api/timesheets/{id} and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query_builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any authenticated user can re-assign their own timesheet to any project in the database — including projects that belong to teams or customers they have no membership in and cannot otherwise see. The user can then read serialized project/customer details via GET /api/timesheets/{id}?full=true, leaking metadata (name, currency, customer hierarchy) that would otherwise be filtered out by the team ACL.

Details

Entry point — only ownership is checked in src/API/TimesheetController.php:317-355

#[IsGranted('edit', 'timesheet')]
#[Route(methods: ['PATCH'], path: '/{id}', name: 'patch_timesheet', requirements: ['id' => '\d+'])]
public function patchAction(Request $request, Timesheet $timesheet): Response
{
    ...
    $form = $this->createForm(TimesheetApiEditForm::class, $timesheet, [...]);
    $form->setData($timesheet);
    $form->submit($request->request->all(), false);
    if (false === $form->isValid()) { ... }
    $this->service->saveTimesheet($timesheet);
    ...
}

src/Voter/TimesheetVoter.php:134-142:

if ($subject->getUser()?->getId() === $user->getId()) {
    return $this->permissionManager->hasRolePermission($user, $permission . '_own_timesheet');
}

if (!$this->permissionManager->checkTeamAccessTimesheet($subject, $user)) {
    return false;
}

For an own-timesheet, only edit_own_timesheet is required. The voter does not look at the new project being submitted; it only validates the existing record's ownership.

Form replays user-controlled project ID into the access query

src/Form/TimesheetEditForm.php:60-71:

$isNew = true;
if (isset($options['data']) && $options['data'] instanceof Timesheet) {
    ...
    if (null !== $entry->getId()) {
        $isNew = false;
    }
    ...
}
$this->addProject($builder, $isNew, $project, $customer);

src/Form/FormTrait.php:59-100:

$builder->addEventListener(
    FormEvents::PRE_SUBMIT,
    function (FormEvent $event) use ($builder, $project, $customer, $isNew, $options): void {
        $data = $event->getData();
        $customer = \array_key_exists('customer', $data) && $data['customer'] !== '' ? $data['customer'] : null;
        $project = \array_key_exists('project', $data) && $data['project'] !== '' ? $data['project'] : $project;

        $event->getForm()->add('project', ProjectType::class, array_merge($options, [
            'group_by' => null,
            'query_builder' => function (ProjectRepository $repo) use ($builder, $project, $customer, $isNew) {
                $project = \is_string($project) ? (int) $project : $project;
                ...
                if ($isNew && \is_int($project)) {
                    $project = $repo->find($project);
                    if ($project !== null) {
                        if (!$project->getCustomer()->isVisible()) { ... $project = null; }
                        elseif (!$project->isVisible())            { $project = null; }
                    }
                }
                ...
                $query = new ProjectFormTypeQuery($project, $customer);
                $query->setUser($builder->getOption('user'));
                $query->setWithCustomer(true);
                return $repo->getQueryBuilderForFormType($query);
            },
        ]));
    }
);

Two problems compound:

1. The visibility re-check on line 73 is gated on $isNew. For PATCH, $isNew = false, so the closure passes the attacker-supplied ID straight through.
2. Even when $isNew = true (POST), the re-check only validates isVisible() — it does not validate team membership.

The query-builder unconditionally accepts the submitted ID

…