CVE-2026-80201
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
- Affected products
- Kimai
- CVSS 4.0
- 2.0 LOW
- CVSS 3.1
- 2.0 LOW
- EPSS
- 0.2% (10th percentile)
- Weakness
- CWE-94
- NVD status
- Deferred
- Published
- 2026-08-25
CVE-2026-80201 at NVD
No indexed exploits for CVE-2026-80201 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-80201 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.