Low severity · published Aug 25, 2026
CVE-2026-80201
Kimai before 2.53.0 API Token Leakage via Invoice Template
2.0
CVSS
0.2%
EPSS
No
On KEV
Description
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kimai · kimai
before 2.53.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80201
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80201
vendor-advisory
https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc
third-party-advisory
https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template
More from kimai
9.6
CVE-2020-19825
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges
9.1
CVE-2026-52824
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
8.8
CVE-2026-80202
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter
8.8
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry
8.8
CVE-2023-53957
Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking