AIKIDO-2026-697860

TL;DR

The QuickEntry weekly-hours controller creates new timesheet records for a selected user without checking the create_other_timesheet permission. An authenticated user who holds view_other_timesheet and edit_other_timesheet but is denied create_other_timesheet can submit the QuickEntry form to create time records for members of teams they lead. This bypasses the create authorization gate enforced by the API and other creation paths, enabling fabrication of billable hours, budget inflation, or attributing work to another user. The fix adds explicit create-permission voting in the timesheet voter and service and hides the user switcher when create_other_timesheet is missing.