"GET /api/timesheets?user=<id>" (and "users[]=<id>") returns the targeted user's timesheet records to any caller that has the "view_other_timesheet" permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint "GET /api/timesheets/{id}" correctly enforces this check via "TimesheetVoter"/"RolePermissionManager::checkTeamAccessTimesheet" → "checkTeamLeadAccess", but the list endpoint only filters projects/customers by team membership and never validates "t.user". A "ROLE_TEAMLEAD" user can therefore enumerate any user's records — including the "rate" field — as long as those records are on a project with no team scoping (Kimai's default) or on any project that shares any team (membership, not lead) with the requester.