CVE-2026-80201 - Kimai before 2.53.0 API Token Leakage via Invoice Template

Back Back to CVE browser

LOW

Kimai before 2.53.0 API Token Leakage via Invoice Template

Published Aug 25, 2026

2.0

LOW

CVSS 4.0

EPSS 0.26%

Description

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Affected products

Vendor Kimai Product Kimai Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.53.0
- Version
  2.53.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kimai

unaffected

Version	Status	Constraints
0	affected	<2.53.0
2.53.0	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (2)

https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc
exploitvendor-advisory
https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template
third-party-advisory

Link	Providers	Tags
https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc		exploitvendor-advisory
https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template		third-party-advisory