Cross-Site Request Forgery in kimai2

CSRF in saving invoices / modifying status of invoices pending and cancel only...