Executive brief
Kimai is a time-tracking and invoicing application. Before version 2.53.0, administrators with template creation permissions could embed API token extraction code in invoice templates. When any user generates an invoice using a compromised template, their API tokens are leaked into the rendered invoice output, potentially exposing credentials to unauthorized access.
Technical details
The vulnerability exists in the Twig sandbox security policy (StrictPolicy::checkMethodAllowed()) which maintains a blocklist of sensitive User methods to prevent unauthorized access. The blocklist covers password-related methods but fails to include getApiToken() and getPlainApiToken(). An attacker with template creation permissions (ROLE_ADMIN with manage_invoice_template permission) can craft an invoice template that calls these methods, causing bcrypt or sodium-hashed API passwords to be included in rendered invoice output. The attack requires administrator privileges and template upload functionality to be enabled (OnPremise only, not cloud versions). The vulnerability was patched in version 2.53.0 by replacing the hardcoded blocklist with a dynamic exclusion mechanism that blocks methods containing sensitive trigger words.
Affected products
- Kimai Kimai before 2.53.0
Timeline
- 2026-04-11: disclosed: GitHub Security Advisory GHSA-rh42-6rj2-xwmc published
- 2026-08-26: advisory: CVE-2026-80201 published on NVD