# CVE-2026-80201: Kimai Twig invoice template sandbox escape via unblocked User methods

Source: https://junglewise.ai/threats/cve-2026-80201-kimai-twig-invoice-template-sandbox-escape-via-unblocked-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80201 · Severity: low · CVSS 3.1 · Published 2026-08-26

Kimai is a time-tracking and invoicing application. Before version 2.53.0, administrators with template creation permissions could embed API token extraction code in invoice templates. When any user generates an invoice using a compromised template, their API tokens are leaked into the rendered invoice output, potentially exposing credentials to unauthorized access.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-80201 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80201 being exploited in the wild.

**How severe is CVE-2026-80201?** Low severity, with a CVSS score of 3.1, published 26 August 2026.

**Which products and versions are affected?** Kimai before 2.53.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.53.0.

**Is there a fix for CVE-2026-80201?** Yes. kimai/kimai (Packagist): upgrade to 2.53.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80201 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-80201?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.53.0 or later

  ```sh
  composer require kimai/kimai:^2.53.0
  ```


## Technical details

The vulnerability exists in the Twig sandbox security policy (StrictPolicy::checkMethodAllowed()) which maintains a blocklist of sensitive User methods to prevent unauthorized access. The blocklist covers password-related methods but fails to include getApiToken() and getPlainApiToken(). An attacker with template creation permissions (ROLE_ADMIN with manage_invoice_template permission) can craft an invoice template that calls these methods, causing bcrypt or sodium-hashed API passwords to be included in rendered invoice output. The attack requires administrator privileges and template upload functionality to be enabled (OnPremise only, not cloud versions). The vulnerability was patched in version 2.53.0 by replacing the hardcoded blocklist with a dynamic exclusion mechanism that blocks methods containing sensitive trigger words.

## Affected products

- Kimai Kimai before 2.53.0

## Identifiers

- CVE-2026-80201
- GHSA-rh42-6rj2-xwmc

## Timeline

- 2026-04-11: disclosed: GitHub Security Advisory GHSA-rh42-6rj2-xwmc published
- 2026-08-26: advisory: CVE-2026-80201 published on NVD

## References

- [https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc](https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc)
- [https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template](https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)