CVE-2026-23626
Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
- Affected products
- Kimai
- Kimai
- < 2.46.0
- Fix
- Available
- CVSS 3.1
- 6.8 MEDIUM
- EPSS
- 0.4% (34th percentile)
- Weakness
- CWE-1336
- NVD status
- Analyzed
- Published
- 2026-01-18
No indexed exploits for CVE-2026-23626 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-23626 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.