CVE-2026-52819: Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

GET /api/timesheets?user=<id> (and users[]=<id>) returns the targeted user’s timesheet records to any caller that has the view_other_timesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/{id} correctly enforces this check via TimesheetVoter/RolePermissionManager::checkTeamAccessTimesheet → checkTeamLeadAccess, but the list endpoint only filters projects/customers by team membership and never validates t.user. A ROLE_TEAMLEAD user can therefore enumerate any user’s records — including the rate field — as long as those records are on a project with no team scoping (Kimai’s default) or on any project that shares any team (membership, not lead) with the requester.