Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-80194Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Medium 4.3

In plain English

A medium-severity information exposure in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	0 – before 2.64.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-pvc4-crg3-gj44) vendor-advisory
VulnCheck Advisory: Kimai before 2.64.0 Missing Authorization via ProjectViewController export third-party-advisory