Kimai
CVE-2026-80194
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-complexity exploit requiring only authenticated access; confidentiality high due to business data exposure, with no integrity or availability impact supported by the description.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.
AnalysisAI
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download the full project overview export via the unprotected report_project_view_export route, exposing customer names, project names, currency, budget type, and aggregate totals across all customers. The root cause is a misplaced authorization guard attached to the __invoke method on a sibling route rather than at the controller class level, leaving the export route with no access control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in Kimai with at minimum ROLE_USER - the lowest-privilege role available to any registered user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N overstates real-world impact: the description identifies only an information disclosure - there is no integrity or availability impact described, making VI:H and VA:H inconsistent with the actual behavior and likely a scoring error that should be verified against the vendor advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid Kimai account - such as a contractor, part-time employee, or low-privilege internal user with only ROLE_USER - directly requests the `report_project_view_export` route in their browser or via an HTTP client. The request succeeds without any permission check, returning the full project overview export file containing all customer names, project identifiers, currencies, budget types, and aggregate financial totals across every customer in the system. … |
| Remediation | The primary fix is to upgrade Kimai to version 2.64.0 or later, which relocates or replicates the authorization guard to cover the export route. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict Kimai access to only essential users with legitimate business justification, disable the project report export feature if available in settings, and audit recent export activity logs for unauthorized data downloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today