CVE-2026-80201

Published: Ago 26, 2026 Last Modified: Ago 26, 2026

ExploitDB:

Other exploit source:

Google Dorks:

LOW 2,0

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: passive

Confidentiality: N/A

Integrity: N/A

Availability: N/A

LOW 2,0

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: required

Scope: unchanged

Confidentiality: low

Integrity: none

Availability: none

Description

AI Translation Available

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Improper Control of Generation of Code ('Code Injection')

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Access Control Integrity Confidentiality Availability Non-Repudiation

Potential Impacts:

Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities

Applicable Platforms

Languages: Interpreted

Technologies: AI/ML

Likelihood of Exploit: Medium

View CWE Details

https://github.com/kimai/kimai/security/advisories/GHSA-rh4…

https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc