ID:12657 - Exploit for Incorrect authorization in kimai2

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing voter check. A remote user can enumerate, read, modify and permanently delete timesheets belonging to any other user in the target system.

Remediation