CVE-2026-80201CWE-94code-injection

CVE-2026-80201

Low · published August 26, 2026

CVSS v3.1
2.0
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
2.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00227 · 12.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-26T09:18Z
References (3)
https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc · [email protected]https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template · [email protected]https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 25 AUG 23:19Z
    Kimai before 2.53.0 API Token Leakage via Invoice Template
    cvelistv5