Kimai CVE-2026-80194

Exploitation requires a valid authenticated session in Kimai with at minimum ROLE_USER - the lowest-privilege role available to any registered user. No special configuration is needed; the report_project_view_export route is a standard part of the Kimai application and is accessible in default deployments. The attack does not require admin access, the project_reporting permission, or any elevated role. What limits exploitation is the authentication barrier itself: unauthenticated external attackers cannot exploit this, and the sensitive data exposed (customer names, project names, budget aggregates) excludes actual financial figures, which remain protected in the export template. Organizations where all Kimai users are fully trusted (e.g., single-team internal deployments) face lower practical risk than those with mixed-trust user populations such as contractors or clients with portal accounts.

The provided CVSS 4.0 score of 8.7 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N overstates real-world impact: the description identifies only an information disclosure - there is no integrity or availability impact described, making VI:H and VA:H inconsistent with the actual behavior and likely a scoring error that should be verified against the vendor advisory. A corrected assessment yields a more moderate risk profile closer to a 6.5 in CVSS 3.1 terms. That said, the confidentiality impact is genuine and business-sensitive: exposure of all customer names, project names, and budget aggregates across an organization's entire Kimai deployment represents material data leakage for any company relying on Kimai for client billing and project tracking. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified, making this a real priority for patch management rather than emergency incident response. The attack requires only a valid user account - no elevated privileges - which lowers the exploitation bar considerably in environments with broad employee access. EPSS data was not provided, but given the ease of exploitation and lack of special conditions, real-world exploitation probability is non-trivial for any internet-exposed Kimai instance with multiple users.

An attacker with any valid Kimai account - such as a contractor, part-time employee, or low-privilege internal user with only ROLE_USER - directly requests the report_project_view_export route in their browser or via an HTTP client. The request succeeds without any permission check, returning the full project overview export file containing all customer names, project identifiers, currencies, budget types, and aggregate financial totals across every customer in the system. The attacker saves or exfiltrates this file, gaining a complete picture of the organization's client portfolio and project budget structure without any special tooling or exploit code.