What’s Vulnerable › Vulnerabilities

CVE-2026-80201: Kimai before 2.53.0 API Token Leakage via Invoice Template

• Severity: low (CVSS 2.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-10-08
• Weakness: CWE-94

Description

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Affected products

• kimai: before 2.53.0 — fixed in 2.53.0

How to fix

Upgrade to a fixed version: kimai 2.53.0. Check the vendor advisory for mitigations.

References

• https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc
• https://www.vulncheck.com/advisories/kimai-before-2.53.0-api-token-leakage-via-invoice-template
• https://github.com/kimai/kimai/security/advisories/GHSA-rh42-6rj2-xwmc

Get alerted when CVE-2026-80201 or the next vulnerability affects your stack