Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-80198Kimai before 2.56.0 Information Disclosure via config() Twig Function

High 7.5

In plain English

A high-severity security flaw in kimai from kimai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.56.0	GHSA-vrqv-52x7-rm4v

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	0 – before 2.56.0

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-vrqv-52x7-rm4v) vendor-advisory
VulnCheck Advisory: Kimai before 2.56.0 Information Disclosure via config() Twig Function third-party-advisory