Is CVE-2026-80198 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80198 being exploited in the wild.

How severe is CVE-2026-80198?

High severity, with a CVSS score of 7.5, published 26 August 2026.

Which products and versions are affected?

Kimai before 2.56.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.56.0.

Is there a fix for CVE-2026-80198?

Yes. kimai/kimai (Packagist): upgrade to 2.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80198 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80198?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80198: Kimai Twig config() function information disclosure in templates

CVE-2026-80198 · Severity: high · CVSS 7.5 · Published 2026-08-26

Kimai is a time-tracking and invoicing platform used by organizations to manage employee timesheets and generate billing documents. Administrators can upload custom templates for invoice and export generation. A vulnerability allows admin users to embed code in these templates that reads sensitive server configuration including LDAP passwords and SAML encryption keys, which are then exposed in invoices or reports that other employees download. This could lead to unauthorized access to company directory systems and forged authentication tokens.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-80198 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80198 being exploited in the wild.
How severe is CVE-2026-80198?: High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?: Kimai before 2.56.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.56.0.
Is there a fix for CVE-2026-80198?: Yes. kimai/kimai (Packagist): upgrade to 2.56.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80198 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80198?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.56.0 or later
```
composer require kimai/kimai:^2.56.0
```

Technical details

The Twig sandbox in Kimai's invoice and export template renderers allow-lists the config() function without filtering accessible keys. The config() function delegates to SystemConfiguration::find(), which returns arbitrary entries from the flattened kimai.config container parameter containing secrets such as ldap.connection.password and saml.connection.sp.privateKey. An authenticated attacker with admin privileges (ROLE_SUPER_ADMIN with upload_invoice_template permission) can craft a malicious template that renders these secrets into invoice PDFs, HTML exports, or CSV/XLSX files that are downloaded by lower-privileged users (teamleads, invoicing admins). The vulnerability requires admin account compromise or insider threat; the rendered output (invoices, exports) is then accessible to users with INVOICE permissions. The fix in version 2.56.0 restricts the config() function to a whitelist of safe theme-related keys only.

Affected products

Kimai Kimai before 2.56.0

Identifiers

CVE-2026-80198
GHSA-vrqv-52x7-rm4v

Timeline

2026-04-27: disclosed
2026-08-26: advisory
2026-04-27: patched: version 2.56.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.