CVE-2026-80198
Received Received - Intake

Kimai Admin Template Sandbox Escape Leading to Credential Exposure

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80198

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.56.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Kimai versions before 2.56.0. It involves the Twig config() function in sandboxed invoice and export templates, which allows administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets like LDAP bind passwords and SAML private keys into documents accessible to lower-privileged users.

Detection Guidance

Check Kimai version with: grep -r "version" /path/to/kimai/composer.json. If version is below 2.56.0, the system is vulnerable. Inspect uploaded templates for Twig config() function usage in invoice or export templates.

Impact Analysis

A malicious or compromised super admin could upload a malicious template to leak system-wide secrets during invoice or export generation. These secrets could then be accessed by lower-privileged users, potentially exposing sensitive data like LDAP bind passwords or SAML private keys.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of personal or health information. Exposure of secrets like LDAP bind passwords or SAML keys may result in data breaches.

Mitigation Strategies

Upgrade Kimai to version 2.56.0 or later immediately. Review and remove any custom or suspicious invoice/export templates. Restrict admin privileges to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart