CVE-2026-80201: Kimai before 2.53.0 API Token Leakage via Invoice Template
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to create or modify invoice templates. The issue also requires an administrator context whose user object exposes the sensitive API-token methods to the Twig template.
What access or interaction is required for exploitation?
The attacker must embed calls to getApiToken() or getPlainApiToken() in an invoice template and have that template rendered into invoice output. The affected access vector is network-based, but exploitation has high attack complexity, requires high privileges, and requires user interaction.
What data can be exposed?
Rendered invoice output can disclose hashed API tokens. The provided information indicates confidentiality impact only; no integrity or availability impact is identified.
How can I determine whether an instance is affected?
Kimai versions before 2.53.0 are affected. Review invoice templates created or modified by users with template-creation permissions for calls to getApiToken() or getPlainApiToken(), and inspect rendered invoice output for exposed token values.
What can be done if upgrading is not immediately possible?
Restrict invoice-template creation and modification permissions to fully trusted administrators. Audit existing templates for the identified method calls and remove or replace any templates containing them.