CVE-2026-80198CWE-693

CVE-2026-80198

High · published August 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-08-26T09:18Z
References (2)
https://github.com/kimai/kimai/security/advisories/GHSA-vrqv-52x7-rm4v · [email protected]https://www.vulncheck.com/advisories/kimai-before-2.56.0-information-disclosure-via-config-twig-function · [email protected]
EPSS history
Timeline
  • 25 AUG 23:19Z
    Kimai before 2.56.0 Information Disclosure via config() Twig Function
    cvelistv5