Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass (CVE-2026-52820) | HOL Guard CVE