【低危】kimai：权限控制风险（GHSA-j5mc-p8qg-39j7）

安全情报快照 · 风险级别：低危 · GHSA-j5mc-p8qg-39j7

先看结论

kimai存在权限控制风险，<= 2.56.0 受影响，建议升级至 2.57.0。

影响范围

处置建议

优先将 kimai/kimai 升级至 2.57.0 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This allows cross-user manipulation of per-user favorite state without administrative privileges.

Details

The issue affects the following routes:

• GET /en/favorite/timesheet/add/{id}
• GET /en/favorite/timesheet/remove/{id}

Both endpoints accept a user-controlled timesheet identifier and only require the caller to hold the generic start_own_timesheet permission. They do not verify that the referenced Timesheet object belongs to the currently authenticated user.

• In src/Controller/FavoriteController.php, the controller methods accept a Timesheet object directly and forward it to the favorite service.
• The root cause becomes more obvious in src/Timesheet/FavoriteRecordService.php. The bookmark owner is derived from $timesheet->getUser() instead of the current session user.
• Because of this design, any authenticated user who can reference another user's timesheet ID can modify the victim's favorite/recent bookmark data.

A PoC was provided, but removed for security reasons.

Impact

This vulnerability allows any authenticated low-privileged user to manipulate another user's favorite bookmark state across accounts. An attacker can inject arbitrary victim-owned timesheet entries into the victim's quick-entry workflow, remove existing favorites, and repeatedly disturb the victim's normal timesheet usage without needing administrative privileges.

The issue does not directly disclose sensitive data, but it is a real cross-user business-state tampering vulnerability with clear integrity impact. Because the add and remove endpoints can be combined, an attacker can reliably insert, remove, and reorder entries in another user's favorite/recent list.

来源与许可

• GitHub Advisory GHSA-j5mc-p8qg-39j7
• https://github.com/kimai/kimai/security/advisories/GHSA-j5mc-p8qg-39j7
• https://www.kimai.org/en/security/ghsa-j5mc-p8qg-39j7

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。