Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-80201Kimai before 2.53.0 API Token Leakage via Invoice Template
Low 2.0
In plain English
A low-severity code injection in kimai from kimai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.0Low
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | kimai/kimai | 2.53.0 | GHSA-rh42-6rj2-xwmc |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-rh42-6rj2-xwmc) vendor-advisory
- VulnCheck Advisory: Kimai before 2.53.0 API Token Leakage via Invoice Template third-party-advisory