Kimai CVE-2026-80201

Exploitation requires all of the following concrete conditions: (1) Kimai must be an OnPremise self-hosted installation - cloud deployments are not affected; (2) the invoice template upload feature must be activated in the instance configuration, which is not the default state; (3) the attacker must hold ROLE_ADMIN or higher AND possess the manage_invoice_template permission; (4) a victim user must generate an invoice using the malicious template after it has been set as default - passive deployment alone is insufficient. Exploitation is limited by the fact that leaked tokens are hashed (bcrypt/sodium), not plaintext, and API tokens are deprecated in Kimai since April 2024. Legitimate admin access to template management is the primary barrier; there is no unauthenticated or low-privilege exploitation path.

Real-world risk is materially lower than the CWE-94 classification might suggest. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:P) and score of 2.0 accurately reflect the high barriers: exploitation demands ROLE_ADMIN or higher with the manage_invoice_template permission, a specific non-default installation mode (OnPremise with template upload enabled), and a victim user who subsequently generates an invoice using the malicious template. No KEV listing exists and no public exploit tool is identified at time of analysis - though the GHSA advisory provides step-by-step reproduction steps, lowering the skill bar for any attacker already holding admin credentials. The leaked data is bcrypt or sodium-hashed API tokens, not plaintext passwords or session credentials, further limiting post-exploitation utility. Additionally, Kimai's vendor notes that API tokens have been deprecated since April 2024, narrowing the population of deployments where token compromise carries meaningful consequence. EPSS data is not provided; given the high privilege prerequisite and niche product, opportunistic mass exploitation is implausible.

An administrator with the manage_invoice_template permission logs into a self-hosted Kimai instance and creates a new Twig invoice template containing {{ model.user.getApiToken() }} and {{ model.user.getPlainApiToken() }}, then sets it as the default template for one or more customers. When any regular user assigned to those customers subsequently generates an invoice, the rendered output silently includes their hashed API token, which the admin can retrieve from the invoice document. The GHSA advisory provides complete step-by-step reproduction instructions, lowering the execution bar for any attacker already possessing admin credentials.