CVE-2026-80201

EUVD-2026-66223
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
2 LOW
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.03%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
kimaikimai
𝑥
< 2.53.0
CNA
Common Weakness Enumeration
References
https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc
https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template
https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc