CVE-2026-80194 Overview
CVE-2026-80194 is a missing authorization vulnerability in Kimai time-tracking software before version 2.64.0. The flaw resides in the ProjectViewController export route (report_project_view_export). Authorization guards were attached to the sibling __invoke method rather than at the class level. As a result, the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER account without the project_reporting permission, can download the project overview export. The export exposes customer names, project names, currency, budget type, and aggregate totals across all customers. This vulnerability is classified under CWE-200: Information Exposure.
Critical Impact
Any authenticated low-privilege Kimai user can exfiltrate the full project overview dataset, disclosing customer and project metadata across the entire tenant.
Affected Products
- Kimai versions prior to 2.64.0
- ProjectViewController component (report_project_view_export route)
- Deployments granting ROLE_USER access without additional network isolation
Discovery Timeline
- 2026-08-26 - CVE-2026-80194 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80194
Vulnerability Analysis
Kimai is an open-source time-tracking application built on Symfony. Symfony controllers commonly use PHP attributes (#[IsGranted(...)]) or annotations to enforce role-based authorization on controller actions. In the vulnerable release, the authorization guard protecting project reporting was declared on the __invoke method of ProjectViewController. Symfony evaluates such guards only on the specific method they decorate. The export action, report_project_view_export, is a separate route handler in the same class and therefore executes without any permission check.
Any user session holding a valid Kimai authentication token can request the export endpoint directly. The controller returns the identical dataset produced by the protected project report view. Sensitive fields disclosed include customer identifiers, project identifiers, currency codes, budget type, and cross-customer aggregate totals. Actual financial values remain redacted in the export template, which limits but does not eliminate the exposure.
Root Cause
The root cause is misplaced authorization metadata. Guards belong on every entry point that returns protected data, or at the class level covering all actions. Attaching the guard only to __invoke created a silent bypass for the export sibling route. This is a classic broken access control pattern where authentication is verified but authorization is not enforced per action.
Attack Vector
Exploitation requires network access to a Kimai instance and any valid low-privilege account. The attacker authenticates, then issues a GET request to the report_project_view_export route. No specific project_reporting permission is required. Kimai returns the export file containing project and customer metadata for the entire installation. The vulnerability requires no user interaction and no elevated privileges. See the Kimai GitHub Security Advisory GHSA-pvc4-crg3-gj44 and the VulnCheck Advisory for Kimai for the vendor-confirmed technical description.
Detection Methods for CVE-2026-80194
Indicators of Compromise
- Web server access log entries showing GET requests to routes matching report_project_view_export from accounts lacking the project_reporting permission.
- Unexpected export file downloads by ROLE_USER accounts that historically never accessed project reporting features.
- Bulk or automated export requests originating from a single session within a short time window.
Detection Strategies
- Correlate authenticated session identifiers with the Kimai user role and alert when non-reporting roles hit the export route.
- Review application logs for HTTP 200 responses on the export route paired with user IDs outside the reporting group.
- Baseline normal usage of report_project_view_export and flag deviations by user, source IP, or frequency.
Monitoring Recommendations
- Forward Kimai and reverse-proxy access logs to a centralized analytics platform for cross-user correlation.
- Enable Symfony security audit logging to capture authorization decisions on every controller action.
- Monitor egress traffic from the Kimai host for outbound transfers immediately following export requests.
How to Mitigate CVE-2026-80194
Immediate Actions Required
- Upgrade Kimai to version 2.64.0 or later, which relocates the authorization guard to cover the export route.
- Audit all user accounts and revoke sessions for users who accessed report_project_view_export without a legitimate reporting role.
- Restrict network access to Kimai administration and reporting routes using an authenticating reverse proxy or VPN.
Patch Information
The fix is included in Kimai 2.64.0. The upstream patch adds authorization enforcement to the project view export action so it inherits the same project_reporting permission check as the report view. Administrators should follow the upgrade instructions in the Kimai GitHub Security Advisory GHSA-pvc4-crg3-gj44.
Workarounds
- Block the report_project_view_export route at the reverse proxy for users outside the reporting group until the upgrade is applied.
- Temporarily disable low-privilege account creation and audit existing ROLE_USER membership.
- Apply web application firewall rules that deny requests to the export route unless the session carries a claim indicating reporting permission.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
