CVE-2026-80198highCWE-693

CVE-2026-80198: fallo de gravedad alta en kimai

Kimai before 2.56.0 Information Disclosure via config() Twig Function

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear kimai+ Monitorear kimai/kimai

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.4%
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
kimai · kimai
CVEs relacionadas — kimai

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-46245HIGHKimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig FileEPSS 1.8%CVE-2026-52824CRITICALKimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account TakeoverEPSS 1.3%CVE-2024-29200MEDIUMAPI returns timesheet entries a user should not be authorized to viewEPSS 0.6%CVE-2026-52827HIGHKimai: Two-factor authentication bypass on the Kimai APIEPSS 0.6%CVE-2026-52819MEDIUMKimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the targetEPSS 0.5%CVE-2026-80196HIGHKimai before 2.58.0 Authentication Bypass via Password Reset LinkEPSS 0.5%