Kimai before 2.56.0 fails to enforce team‑membership restrictions in TimesheetVoter::voteOnAttribute(), mapping permissions only to own_timesheet or other_timesheet. Consequently, any authenticated user holding the ROLE_TEAMLEAD role or roles that grant edit_other_timesheet/delete_other_timesheet can read, modify, or permanently delete any user’s timesheet across the entire system. Since timesheet identifiers are simple, incrementing integers, they are trivially enumerable, allowing systematic data tampering or destruction. This flaw directly exposes sensitive work‑history data, allows integrity violations of time records, and can compromise audit trails.

The vulnerability affects all Kimai releases prior to 2.56.0. Users running Kimai versions 2.55 and earlier are impacted; versions 2.56.0 and newer include the fix.

The CVSS base score of 9.3 indicates high severity. The EPSS score is not available, but the flaw is listed as not in the CISA KEV catalog, implying no publicly known exploits yet. An attacker must be authenticated and possess a privileged role; once in, the vulnerability enables full, system‑wide access to timesheet data. Because timesheet IDs are sequential, enumeration requires minimal effort, making exploitation relatively straightforward for any authorized jeopardized user.