PT-2026-58946

Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the view other timesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...