CVE-2026-80201
Received Received - Intake

Kimai 2.53.0 Sensitive Method Exposure in Twig Invoice Template

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80201

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.53.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kimai before version 2.53.0 has a flaw in its Twig invoice template sandbox. Admins with template creation permissions can embed calls to getApiToken() or getPlainApiToken() in invoice templates. When these templates render, the hashed API tokens are exposed in the output, leaking sensitive credentials.

Detection Guidance

Check Kimai version with: grep -r '"version"' /path/to/kimai/composer.json. If version is below 2.53.0, the system is vulnerable. Review invoice templates for suspicious method calls like getApiToken() or getPlainApiToken() in Twig files.

Impact Analysis

Attackers with template creation rights could leak hashed API tokens. These hashes are deprecated but could potentially be cracked to gain unauthorized access to user accounts or systems. The impact is limited to on-premise installations where template upload is enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if API tokens grant access to regulated data. However, the low severity and deprecated nature of the leaked hashes reduce the risk of actual compliance violations.

Mitigation Strategies

Upgrade Kimai to version 2.53.0 or later immediately. Disable template upload permissions for non-admin users. Review and remove any custom invoice templates containing getApiToken() or getPlainApiToken() method calls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80201. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart