CVE-2026-80198 in Kimai
Summary
by MITRE • 08/26/2026
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Kimai versions prior to 2.56.0 represents a critical failure in the isolation of template rendering contexts, specifically within the sandboxed environments used for generating invoices and exports. While these templates are intended to be restricted from accessing sensitive server-side logic or arbitrary system configuration data, the underlying Twig engine implementation failed to properly restrict access to the config() function. This oversight allows any user with administrative privileges who can upload custom invoice or export templates to bypass security boundaries that were designed to protect internal application state. The flaw effectively transforms a feature intended for safe document generation into a vector for unauthorized information disclosure and potential remote code execution if combined with other vulnerabilities, although in this specific instance the primary impact is data exfiltration.
From a technical perspective, the core issue lies in how Twig handles variable access within sandboxed modes. Although administrators are generally trusted users, the architecture assumes that templates rendered by lower-privileged users should not be able to inspect or retrieve arbitrary configuration values stored on the server. By leaving the config() function accessible even when running inside these restricted contexts, Kimai allowed an attacker with admin rights to craft a malicious template that invokes this function to read sensitive keys from the application's global configuration array. This includes high-value targets such as LDAP bind passwords used for directory authentication and SAML private keys essential for single sign-on integrity. These secrets are typically considered confidential and should never be exposed through document generation endpoints which might be accessible or viewable by standard users who do not possess administrative privileges.
The operational impact of this vulnerability is severe, primarily due to the potential for privilege escalation via information leakage rather than direct system compromise. An attacker with admin access can systematically exfiltrate credentials that are critical for maintaining the security posture of the entire organization. The retrieval of LDAP bind passwords could allow an adversary to authenticate as service accounts or perform directory enumeration attacks against internal Active Directory environments. Similarly, the exposure of SAML private keys compromises the trust model of single sign-on implementations, potentially allowing attackers to forge authentication assertions and impersonate users across integrated systems. Because these documents are often generated for clients or external parties, there is a significant risk that sensitive credentials could be inadvertently shared with third parties if not carefully monitored, leading to widespread credential compromise and potential regulatory violations regarding data protection standards such as GDPR or HIPAA depending on the industry sector.
This vulnerability aligns closely with CWE-209 which describes the generation of an error message containing sensitive information, although it is more accurately characterized by CWE-798 which involves the use of hard-coded credentials if those secrets were static, but in this case, it is better mapped to CWE-15 Improper External Control of Sensitive Information. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1005 Data from Local System and specifically T1530 Data from Cloud Storage Object if the documents are stored remotely, but more accurately reflects T1213 Data Source Discovery as it involves querying internal configuration structures. The attack vector also touches upon T1078 Valid Accounts since exploitation requires initial administrative access, highlighting that while the vulnerability is severe, its exploitability is gated by the attacker's existing privilege level within the application.
Mitigation strategies must focus on immediate patching and architectural review of template rendering engines. Administrators running Kimai versions before 2.56.0 should upgrade to version 2.56.0 or later immediately where this restriction has been enforced in the Twig sandbox configuration. In addition to upgrading, organizations should audit their current administrative users for any suspicious activity that might indicate prior exploitation of this flaw. It is crucial to rotate all credentials that may have been exposed through this vector, including LDAP bind passwords and SAML private keys, assuming compromise until a thorough forensic analysis confirms otherwise. Furthermore, implementing strict access controls on template upload functionality can reduce the attack surface by limiting who can introduce custom rendering logic into the system. Regular security assessments of third-party libraries like Twig are also recommended to ensure that sandboxing mechanisms remain robust against evolving bypass techniques.