---
id: GHSA-j5mc-p8qg-39j7
title: >-
  Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark
  Manipulation
summary: >-
  Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark
  Manipulation
severity: low
cwe:
  - CWE-639
  - CWE-862
vendor: kimai
product: kimai/kimai
ecosystem: composer
affected:
  - kimai/kimai <= 2.56.0
patched:
  - kimai/kimai 2.57.0
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-j5mc-p8qg-39j7'
references:
  - url: 'https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7'
  - url: 'https://www.kimai.org/en/security/ghsa-j5mc-p8qg-39j7'
  - url: 'https://github.com/advisories/GHSA-j5mc-p8qg-39j7'
tags:
  - ghsa
  - composer
ingestedAt: '2026-07-02T21:44:45.104Z'
---

## Overview

### Summary

Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's `timesheet.id` can add that record to, or remove it from, the victim's `favorite/recent` bookmark list. This allows cross-user manipulation of per-user favorite state without administrative privileges.

### Details

The issue affects the following routes:

- `GET /en/favorite/timesheet/add/{id}`
- `GET /en/favorite/timesheet/remove/{id}`

Both endpoints accept a user-controlled timesheet identifier and only require the caller to hold the generic `start_own_timesheet` permission. They do not verify that the referenced `Timesheet` object belongs to the currently authenticated user.

- In `src/Controller/FavoriteController.php`, the controller methods accept a `Timesheet` object directly and forward it to the favorite service. 
- The root cause becomes more obvious in `src/Timesheet/FavoriteRecordService.php`. The bookmark owner is derived from `$timesheet->getUser()` instead of the current session user.
- Because of this design, any authenticated user who can reference another user's timesheet ID can modify the victim's `favorite/recent` bookmark data.

*A PoC was provided, but removed for security reasons.*

### Impact

This vulnerability allows any authenticated low-privileged user to manipulate another user's favorite bookmark state across accounts. An attacker can inject arbitrary victim-owned timesheet entries into the victim's quick-entry workflow, remove existing favorites, and repeatedly disturb the victim's normal timesheet usage without needing administrative privileges.

The issue does not directly disclose sensitive data, but it is a real cross-user business-state tampering vulnerability with clear integrity impact. Because the add and remove endpoints can be combined, an attacker can reliably insert, remove, and reorder entries in another user's `favorite/recent` list.

## Affected packages

- `kimai/kimai <= 2.56.0`

## Remediation

Upgrade to a patched release:

- `kimai/kimai 2.57.0`