What is CVE-2026-80201?

CVE-2026-80201 is a low-severity vulnerability in Kimai, classified under Code Injection. CVSS score: 2.0/10. Published 2026-08-25.

How severe is CVE-2026-80201?

Low severity. CVSS v3 base score is 2.0 out of 10.

RCE in Kimai

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 2.0 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N.

Affected products

Kimai

Weakness classification (CWE)

CWE-94 — Code Injection

References

GitHub Security Advisory (GHSA-rh42-6rj2-xwmc) (vendor-advisory)
VulnCheck Advisory: Kimai before 2.53.0 API Token Leakage via Invoice Template (third-party-advisory)

Frequently asked questions

What is CVE-2026-80201?: CVE-2026-80201 is a low-severity vulnerability in Kimai, classified under Code Injection. CVSS score: 2.0/10. Published 2026-08-25.
How severe is CVE-2026-80201?: Low severity. CVSS v3 base score is 2.0 out of 10.