CVE-2026-80194: Kimai before 2.64.0 Missing Authorization via ProjectViewController export
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (reportprojectviewexport). The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLEUSER without the projectreporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Kimai user can exploit it, including a user with only the plain ROLE_USER role and no project_reporting permission. No user interaction is required.
What information can be exposed through the export?
The export can disclose the project overview dataset across all customers, including customer names, project names, currency, budget type, and aggregate totals. Actual financial figures remain protected in the export template.
Which installations are affected?
Kimai versions before 2.64.0 are affected. The vulnerable route does not inherit authorization checks because the guards are attached to a sibling __invoke method rather than the export route.