CVE-2026-80201 in Kimai

摘要

由 MITRE • 2026-08-26

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• 负责: VulnCheck
• 预定: 2026-08-26
• 披露: 2026-08-26
• 管理: 已接受
• 条目: VDB-395483
• CPE: 准备好
• CWE: CWE-269 (已确认)
• CVSS: 2.0 (CNA)
• EPSS: 0.00000
• KEV: 否
• 活动: 非常低

来源

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-80201
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80201
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-80201/