High severity · published Aug 25, 2026
CVE-2026-80198
Kimai before 2.56.0 Information Disclosure via config() Twig Function
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kimai · kimai
before 2.56.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80198
vendor-advisory
https://github.com/kimai/kimai/security/advisories/GHSA-vrqv-52x7-rm4v
third-party-advisory
https://www.vulncheck.com/advisories/kimai-before-2.56.0-information-disclosure-via-config-twig-function
More from kimai
9.6
CVE-2020-19825
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges
9.1
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
8.8
CVE-2026-80202
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
8.8
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry
8.8
CVE-2023-53957
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking