Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.

Kimai versions before 2.62.0 contain an authorization bypass vulnerability in the QuickEntry controller. The flaw allows authenticated users who possess view_other_timesheet and edit_other_timesheet permissions to create timesheet records for other team members without having the required create_other_timesheet permission. This occurs because the QuickEntry controller fails to validate the create_other_timesheet permission during timesheet creation. The vulnerability bypasses authorization checks that are properly enforced in other parts of the application. It affects all Kimai installations running versions prior to 2.62.0. The fix is available in Kimai 2.62.0, which properly enforces permission validation in the QuickEntry controller. Organizations using Kimai for time tracking should upgrade immediately to mitigate unauthorized timesheet manipulation risks.