CVE-2026-80198 Overview
CVE-2026-80198 is a high-severity information disclosure vulnerability in Kimai, an open-source time-tracking application. Versions before 2.56.0 fail to restrict the config() Twig function inside sandboxed invoice and export templates. Administrators can craft templates that read arbitrary configuration keys from the Kimai instance. Attackers with admin privileges can exfiltrate server-wide secrets, including Lightweight Directory Access Protocol (LDAP) bind passwords and Security Assertion Markup Language (SAML) private keys, by embedding them into invoice or export documents that lower-privileged users can retrieve.
Critical Impact
A malicious or compromised administrator can leak LDAP credentials, SAML signing keys, and other sensitive configuration values by weaponizing invoice and export templates.
Affected Products
- Kimai time-tracking application, all versions prior to 2.56.0
- Deployments using LDAP or SAML authentication where secrets are stored in configuration
- Kimai instances that expose invoice or export template editing to administrators
Discovery Timeline
- 2026-08-26 - CVE-2026-80198 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80198
Vulnerability Analysis
Kimai uses Twig templates to render invoices and exports. These templates run inside a sandbox intended to restrict access to sensitive application internals. The config() Twig function was not included in the sandbox deny list, so template authors could invoke it to read any configuration key resolved by the Symfony container.
Because invoice and export templates are stored and re-rendered server-side, rendered output is written to files that users below the administrator role can download. This turns a template-authoring privilege into a broad configuration read primitive. The classification aligns with CWE-693: Protection Mechanism Failure.
Root Cause
The root cause is an incomplete sandbox policy in the Twig environment used for invoice and export rendering. The config() function bridges template code to the application configuration layer, which holds authentication secrets. Failing to block this function in the sandbox violated the principle that untrusted or lower-trust content must not reach privileged runtime helpers.
Attack Vector
An attacker with administrative access uploads or modifies an invoice or export template. The template calls config() with keys such as those holding LDAP bind credentials or SAML private keys. When the template renders, the secret is embedded in the generated document. A lower-privileged user, or the attacker acting through a downgraded session, then downloads that document and extracts the secrets.
See the GitHub Security Advisory GHSA-vrqv-52x7-rm4v and the VulnCheck Advisory for Kimai 2.56.0 for authoritative technical details.
Detection Methods for CVE-2026-80198
Indicators of Compromise
- Invoice or export templates containing the string config( or Twig calls that reference configuration namespaces such as ldap, saml, or security.
- Newly created or recently modified templates in the Kimai template directory that were not authored during normal business workflows.
- Rendered invoice or export files containing values that resemble private keys, hashed passwords, or bind DNs.
Detection Strategies
- Grep template repositories and Kimai storage for {{ config( and {% set patterns that pull from configuration namespaces.
- Compare template file hashes against a known-good baseline captured immediately after upgrade to 2.56.0 or later.
- Review Kimai audit logs for template create, edit, and export actions performed by administrator accounts outside expected change windows.
Monitoring Recommendations
- Alert on downloads of invoice or export artifacts whose size or content differs significantly from historical norms.
- Monitor LDAP and SAML identity providers for authentication anomalies that could indicate reuse of leaked bind credentials or signing keys.
- Track administrator session activity in Kimai and correlate template modifications with subsequent document exports.
How to Mitigate CVE-2026-80198
Immediate Actions Required
- Upgrade Kimai to version 2.56.0 or later on all production and staging instances.
- Rotate all secrets referenced in the Kimai configuration, including LDAP bind passwords, SAML private keys, mailer credentials, and database passwords.
- Audit every invoice and export template for calls to config() and remove any that are not from a trusted, reviewed source.
- Reduce the number of accounts holding the administrator role and enforce multi-factor authentication on those that remain.
Patch Information
Kimai 2.56.0 extends the Twig sandbox policy to block the config() function inside invoice and export templates. Refer to the GitHub Security Advisory GHSA-vrqv-52x7-rm4v for the fixed release and upgrade notes.
Workarounds
- Restrict template upload and editing to a single tightly controlled administrator account until the upgrade is complete.
- Remove or quarantine any custom invoice and export templates that are not required for business operations.
- Store LDAP and SAML secrets outside the Kimai configuration file using environment variables managed by a secrets store, so that even a successful read primitive returns opaque references rather than plaintext values.
# Verify the installed Kimai version and confirm the patch is applied
cd /var/www/kimai
php bin/console kimai:version
# Search existing templates for the vulnerable function call
grep -RIn --include='*.twig' 'config(' var/invoices templates/invoice templates/export
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
