Product
Kimai versions prior to 2.62.0 contain an authorization bypass vulnerability allowing authenticated users to create timesheet records for other team members without the required create_other_timesheet permission.