Kimai CVE-2026-80198

Exploitation requires the attacker to hold Kimai administrator privileges sufficient to upload or modify invoice or export templates via the Kimai web interface. The config() function must be called within a Twig template that passes through the StrictPolicy sandbox, which is the standard path for admin-uploaded templates. Secret exfiltration is triggered when any user with document generation permissions (including lower-privileged team leads with invoice rights) generates a document from the malicious template - the admin can also trigger this directly. Limiting factors: external attackers must first compromise a Kimai administrator account before exploitation is possible; Kimai instances where template management is restricted to a single fully-trusted administrator, or where templates are deployed read-only via version control rather than the UI, are not exploitable through this path. Organizations not using LDAP or SAML will have a reduced secrets exposure scope, though any kimai.yaml configuration scalar remains reachable via config() regardless of integration type.

The provided CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N contains a critical metric error: PR:N (no privileges required) is flatly inconsistent with the described exploitation prerequisite of administrator-level access to upload templates. This discrepancy materially inflates the score and should not be used for prioritization without correction. Applying PR:H - which accurately reflects the admin requirement - substantially reduces the realistic threat surface. No EPSS data was provided. KEV status is not confirmed; no active exploitation evidence appears in any provided source. The confidentiality impact is high (VC:H) when exploitation does occur, since exposed credentials - LDAP bind passwords and SAML private keys - can enable lateral movement into directory services and identity providers well beyond Kimai itself. The secondary exfiltration channel through lower-privileged users who receive generated documents complicates detection. Real-world risk is therefore meaningful for organizations where Kimai administrator accounts may be compromised or where insider threat is a concern, but the admin prerequisite prevents mass exploitation and limits exposure compared to an unauthenticated flaw of equivalent impact.

A compromised or malicious Kimai administrator uploads an invoice template containing Twig expressions such as {{ config('ldap.connection.password') }} or {{ config('saml.sp.privateKey') }} embedded in formatted invoice fields. When a team lead or other lower-privileged user with invoice generation permissions generates a client invoice using this template, the rendered PDF or export file contains the plaintext credentials. The attacker retrieves the document - either by accessing the output directly as the admin, or by social engineering the lower-privileged user - and uses the obtained LDAP bind password to authenticate to the organization's directory service for lateral movement.