The Timesheet API "PATCH /api/timesheets/{id}" and "POST /api/timesheets" endpoints accept a user-supplied "project" ID and resolve it through a Symfony "EntityType" whose "query_builder" allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any authenticated user can re-assign their own timesheet to any project in the database — including projects that belong to teams or customers they have no membership in and cannot otherwise see. The user can then read serialized project/customer details via "GET /api/timesheets/{id}?full=true", leaking metadata (name, currency, customer hierarchy) that would otherwise be filtered out by the team ACL.