Authorization Bypass

Kimai is vulnerable to Authorization Bypass. The vulnerability is due to insufficient team-lead authorization checks in the timesheet list API when filtering by user ID, which allows an attacker with viewothertimesheet permission to enumerate other users' timesheet records and disclose sensitive...