Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects mandatory admin-level permission; UI:R because a victim user must generate an invoice; C:L for hashed token disclosure only, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
AnalysisAI
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concrete conditions: (1) Kimai must be an OnPremise self-hosted installation - cloud deployments are not affected; (2) the invoice template upload feature must be activated in the instance configuration, which is not the default state; (3) the attacker must hold ROLE_ADMIN or higher AND possess the manage_invoice_template permission; (4) a victim user must generate an invoice using the malicious template after it has been set as default - passive deployment alone is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than the CWE-94 classification might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator with the manage_invoice_template permission logs into a self-hosted Kimai instance and creates a new Twig invoice template containing {{ model.user.getApiToken() }} and {{ model.user.getPlainApiToken() }}, then sets it as the default template for one or more customers. When any regular user assigned to those customers subsequently generates an invoice, the rendered output silently includes their hashed API token, which the admin can retrieve from the invoice document. … |
| Remediation | Upgrade to Kimai 2.53.0 or later, which resolves the issue by adding getapitoken and getplainapitoken to the StrictPolicy::checkMethodAllowed() blocklist via pull request #5878 (https://github.com/kimai/kimai/pull/5878). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today