CVEvulnerability

CVE-2026-80201

2.0 LOW Published 2026-08-26 Modified 2026-10-08 Official page ↗
Status
Deferred
Published
2026-08-26
Last modified
2026-10-08
Assigner
[email protected]
CVSS 4.0 ([email protected])
2.0 LOW — CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
2.0 LOW — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-94

Description

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References