CVE-2024-29200

Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When requesting all timesheets from the API, however, all timesheet entries are returned, regardless of whether the user shares team permissions or not. This vulnerability is fixed in 2.13.0.

• CWE-1220

• https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94Exploit, Vendor Advisory
• https://github.com/kimai/kimai/security/advisories/GHSA-cj3c-5xpm-cx94Exploit, Vendor Advisory

Published

Mar 28, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29195The azure-c-shared-utility is a C library for AMQP/MQTT comm…8.1
• CVE-2024-29196phpMyFAQ is an open source FAQ web application for PHP 8.1+ …2.7
• CVE-2024-29197Pimcore is an Open Source Data & Experience Management Platf…6.5
• CVE-2024-29198GeoServer is an open source software server written in Java …8.2
• CVE-2024-29199Nautobot is a Network Source of Truth and Network Automation…5.3
• CVE-2024-2920The WP-Members Membership Plugin plugin for WordPress is vul…5.3
• CVE-2024-29201JumpServer is an open source bastion host and an operation a…9.9
• CVE-2024-29202JumpServer is an open source bastion host and an operation a…9.9
• CVE-2024-29203TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-29204A Heap Overflow vulnerability in WLAvalancheService componen…9.8
• CVE-2024-29205An Improper Check for Unusual or Exceptional Conditions vuln…7.5
• CVE-2024-29206An Improper Access Control could allow a malicious actor aut…2.2