Kimai
CVE-2026-80198
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Admin privileges required to upload templates (PR:H); scope changes (S:C) because secrets leak into documents delivered to lower-privileged users and enable compromise of external LDAP/SAML systems.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
3DescriptionCVE.org
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
AnalysisAI
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold Kimai administrator privileges sufficient to upload or modify invoice or export templates via the Kimai web interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N contains a critical metric error: PR:N (no privileges required) is flatly inconsistent with the described exploitation prerequisite of administrator-level access to upload templates. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A compromised or malicious Kimai administrator uploads an invoice template containing Twig expressions such as {{ config('ldap.connection.password') }} or {{ config('saml.sp.privateKey') }} embedded in formatted invoice fields. When a team lead or other lower-privileged user with invoice generation permissions generates a client invoice using this template, the rendered PDF or export file contains the plaintext credentials. … |
| Remediation | Upgrade to Kimai 2.56.0, which is the vendor-released patch confirmed by the GHSA advisory (https://github.com/kimai/kimai/security/advisories/GHSA-vrqv-52x7-rm4v) and VulnCheck. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kimai instances in your environment and confirm whether any run versions earlier than 2.56.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today