CVE-2026-80201: Kimai Information Disclosure Vulnerability

CVE-2026-80201 Overview

CVE-2026-80201 affects Kimai time-tracking software before version 2.53.0. The application fails to block sensitive User methods in the Twig invoice template sandbox. Administrators with template creation permissions can invoke getApiToken() and getPlainApiToken() methods inside invoice templates. Rendering an invoice then exposes hashed API tokens in the invoice output. The flaw stems from an incomplete sandbox policy that treats sensitive getters as safe template functions. The issue is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated administrators can leak hashed API tokens for Kimai users by embedding sensitive method calls in invoice templates.

Affected Products

Kimai versions prior to 2.53.0
Self-hosted Kimai deployments exposing invoice template editing
Kimai instances granting template creation permissions to admins

Discovery Timeline

2026-08-26 - CVE-2026-80201 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80201

Vulnerability Analysis

Kimai renders invoices with Twig templates executed inside a sandbox. The sandbox is designed to restrict which object methods templates can call. The affected releases do not include getApiToken() and getPlainApiToken() in the block list for the User entity. Any Twig invoice template that references the current user or a related user object can call these methods directly. The rendered invoice document then contains the hashed API token string.

The vulnerability is a code injection issue scoped to the templating layer. An attacker with template authoring rights can shape invoice output to include arbitrary user data reachable through unrestricted getters. The disclosed data is a hashed token rather than a cleartext secret, which limits direct reuse but enables offline cracking attempts against weak tokens.

Root Cause

The root cause is an incomplete Twig sandbox policy for the User model. Sensitive accessor methods were not enumerated in the sandbox deny list. The template engine therefore treats API token accessors as permissible functions during invoice rendering.

Attack Vector

Exploitation requires an authenticated administrator with permission to create or modify invoice templates. The attacker adds a Twig expression that invokes user.getApiToken() or user.getPlainApiToken() on an accessible user object. When any invoice is generated using that template, the hashed token appears in the rendered PDF or HTML output. The attacker retrieves the token from downloaded invoice artifacts.

// See the vendor advisory for technical details:
// https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc

Detection Methods for CVE-2026-80201

Indicators of Compromise

Invoice templates containing references to getApiToken, getPlainApiToken, or apiToken Twig expressions.
Generated invoice files (PDF, HTML, spreadsheet) containing bcrypt-style or hashed strings in unexpected fields.
Recent modifications to invoice templates by administrator accounts without a documented change request.

Detection Strategies

Audit the Kimai invoice template store for Twig expressions that access User accessor methods beyond display names and email.
Review web server access logs for unusual /invoice/ generation activity followed by template edits.
Compare deployed Kimai version against 2.53.0 release notes to confirm exposure.

Monitoring Recommendations

Alert on administrative changes to invoice templates in Kimai audit logs.
Monitor outbound transfers of generated invoice files from application storage.
Track API authentication attempts from unusual sources after any suspected template abuse.

How to Mitigate CVE-2026-80201

Immediate Actions Required

Upgrade Kimai to version 2.53.0 or later on all instances.
Rotate API tokens for any user whose token may have been rendered into an invoice.
Review historical invoice artifacts for embedded token strings and purge affected files.
Restrict the administrator role assignment to a minimal, trusted set of accounts.

Patch Information

The fix is included in Kimai 2.53.0. The maintainers extended the Twig sandbox policy to block sensitive User accessors. Details are published in the Kimai GitHub Security Advisory GHSA-rh42-6rj2-xwmc and the VulnCheck advisory on Kimai.

Workarounds

Remove template authoring permissions from administrators until upgrade is complete.
Manually review each custom invoice template and strip any calls to User object methods other than display fields.
Disable invoice rendering for untrusted templates by reverting to shipped default templates.

bash

# Upgrade Kimai using Composer on a self-hosted deployment
git fetch --tags
git checkout 2.53.0
composer install --no-dev --optimize-autoloader
bin/console kimai:update