CVE-2026-80194

Executive Summary

CVE-2026-80194 is a missing authorization vulnerability in Kimai, an open-source time-tracking application, affecting versions before 2.64.0. The flaw resides in the ProjectViewController export route (report_project_view_export), where authorization guards were incorrectly attached to the sibling __invoke method rather than at the class level, leaving the export route completely unprotected. Any authenticated user — including those with only the basic ROLE_USER role and lacking the project_reporting permission — can download the project overview export, which discloses sensitive business information such as customer names, project names, currency, budget type, and aggregate totals across all customers. The vulnerability has a CVSS score of 4.3 (Medium) and is currently unpatched in affected versions, with no public exploit code, Nuclei template, or CISA KEV listing identified.

Technical Analysis

The vulnerability exists in Kimai's ProjectViewController class, which handles the project reporting functionality. The application implements controller-level authorization checks to restrict access to certain actions based on user permissions. In this specific case, the authorization guard (likely using Symfony's SensioFrameworkExtraBundle @IsGranted annotations or similar attribute-based access control) was attached to the __invoke method of the controller, which serves as the default routing handler for the controller class.

However, the export route (report_project_view_export) is mapped to a separate method within the same controller. When Symfony routes a request to this export method, it does not execute the __invoke method and therefore never triggers the authorization checks attached to it. Symfony's attribute-based authorization (via @Security, @IsGranted, or the newer PHP 8 attributes) only applies to the specific method it decorates, not to the entire class — unless explicitly specified at the class level. The developer appears to have assumed that guarding the __invoke method would protect all routes in the controller, which is an incorrect assumption and constitutes the root cause of this authorization bypass.

The affected export route returns the same dataset as the protected project report view, which includes customer names, project names, currency information, budget type, and aggregate totals. Critically, the NVD description notes that "actual financial figures remain protected in the export template," meaning the most sensitive monetary values (such as exact budget amounts or revenue figures) are not exposed. However, the exposed metadata still constitutes a confidentiality breach, as it reveals organizational structure, client relationships, project naming conventions, and business operations to unauthorized parties.

The attack surface is any Kimai installation running version 2.63.x or earlier that is accessible to authenticated users. Since the vulnerability requires only an authenticated session, even the lowest-privileged users (ROLE_USER) can exploit it. The authorization bypass is triggered simply by accessing the exported route directly, bypassing the UI controls that would normally restrict access to the reporting function.

From a vulnerability class perspective, this is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically an instance of missing/inconsistent authorization (often categorized as CWE-862 — Missing Authorization). The flaw is not an authentication bypass (the user must be authenticated) but rather an authorization bypass where the permission model is inconsistently applied across different methods of the same controller.

Exploitation Scenarios

1) Reconnaissance / Target Identification: An attacker with low-level access to a Kimai instance (such as a contractor or freelancer with ROLE_USER standing) identifies that the application runs Kimai. They may discover this through the application's login page, footer branding, or HTTP response headers. The attacker maps the application's routing structure by exploring the UI and noting the existence of reporting/export functionality.

2) Triggering the Vulnerability: The attacker navigates directly to the export route (report_project_view_export) via a crafted URL. Because the authorization guard is attached only to the __invoke method and not to the class as a whole, the export method's request passes through without any permission checks. No special payload or injection is required — this is a pure authorization bypass triggered by direct URL access. The attacker does not need to manipulate parameters, headers, or session data.

3) Payload/Execution Method: At the vulnerability-class level, the attack is a direct endpoint access bypass. The attacker constructs an HTTP GET (or POST, depending on the route configuration) request to the export endpoint. Since no authorization intercepts this request beyond the basic authentication layer, the application processes it and returns the export data (likely as CSV, XLSX, or similar format). The attacker does not need to craft a payload — the vulnerability is triggered by normal, valid request semantics. No public PoC is available; this attack chain is inferred from the vulnerability class and NVD description.

4) Post-Exploitation Impact: The attacker receives the project overview export containing customer names, project names, currency, budget type, and aggregate totals across all customers. This data can be leveraged for competitive intelligence, social engineering (knowing client names and relationships), or further targeted attacks. The attacker could also combine this data with other business intelligence gathered through legitimate low-privilege access to build a detailed picture of the organization's operations. Since the exported data covers all customers (not just the attacker's own projects), the scope of exposure is organization-wide.

Impact Assessment

Confidentiality Impact (Low per CVSS): The primary impact is unauthorized disclosure of project metadata. Customer names, project identifiers, currency information, and budget-type classifications leak to unauthorized users. While exact financial figures remain protected, the exposed metadata reveals business relationships and operational structure.

Integrity and Availability (None per CVSS): The vulnerability does not allow data modification or denial of service. It is a pure information disclosure flaw.

Blast Radius: All Kimai installations running versions below 2.64.0 are affected. The exposed data spans all customers and projects within a single Kimai instance, meaning a compromise affects the entire client portfolio of the deploying organization, not just individual users' data.

Business Impact: For organizations using Kimai as a time-tracking and billing solution, the disclosure of customer names and project structures to unauthorized users (including external contractors) could violate client confidentiality agreements, damage trust, or provide competitors with insight into the organization's client base. The data could be used for targeted phishing campaigns against identified clients.

CVSS Interpretation (4.3 Medium): The low CVSS score reflects the limited confidentiality impact (C:L) and the requirement for an authenticated session (PR:L). However, in the context of multi-tenant SaaS deployments of Kimai or organizations with strict client-confidentiality requirements, the real-world impact could exceed the CVSS rating.

Detection Guidance

Sigma Rule

title: Kimai Project Export Authorization Bypass
id: 8b3c5e2a-9f47-4d6c-b8a1-3e9d2c7b4f10
status: experimental
description: Detects access to Kimai project export route by users without project reporting role
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: web
    product: apache
    definition: 'Requires access logs from Kimai application server'
detection:
    selection:
        cs-method: GET
        cs-uri-stem contains: report_project_view_export
    filter_known:
        cs-username contains: admin
    condition: selection and not filter_known
level: high
falsepositives:
    - Legitimate administrators accessing the export feature
    - Users with the project_reporting permission using the export
tags:
    - attack.t1190
    - cwe.200
    - cve.2026.80194

YARA Rule

rule CVE_2026_80194_Kimai_Export_Bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect log entries or web traffic referencing Kimai project export route with low-privilege accounts"
        date = "2026-01-15"
        cve = "CVE-2026-80194"
        reference = "Kimai < 2.64.0 - Missing Authorization in ProjectViewController"
    strings:
        $export_route = "report_project_view_export"
        $param_route = "path=/en/project/"
        $header_ref = "referer: /en/project/"
        $export_ext = ".xlsx"
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-80194 - Kimai Project Export Authorization Bypass Attempt"; flow:to_server,established; content:"GET"; http_method; content:"report_project_view_export"; http_uri; content:"!text/xml"; http_accept; content:"200"; http_stat_code; sid:8020194; rev:1; classtype:attempted-information-leak; reference:cve,2026-80194;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [http where request.method == "GET" and request.uri.path in ("/project/export", "/*/project/export")]
  [http where response.status_code == 200 and response.body.content_type == "application/csv"]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| where match(uri_path, "(?i)report_project_view_export")
| search NOT user="admin" NOT user="administrator"
| stats count by clientip, user, uri_path, status
| where status=200
| table _time, clientip, user, uri_path, status, count

Wazuh OSSEC Rule

<group name="web, kimai, cve_2026_80194,">
  <rule id="434806" level="12">
    <decoded_as>web</decoded_as>
    <match>report_project_view_export</match>
    <regex>GET \S+report_project_view_export</regex>
    <description>CVE-2026-80194 - Kimai project export accessed (potential authorization bypass)</description>
    <group>kimai_exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. As of this report, no vendor-published security patch exists for CVE-2026-80194. The fix is scheduled for inclusion in Kimai version 2.64.0. All installations running versions below 2.64.0 remain vulnerable.

Immediate Mitigations (to apply pending the 2.64.0 release):

1. If the project reporting feature is not essential for low-privilege users, restrict access to the export route at the web server layer. In nginx or Apache, block requests matching the report_project_view_export URL pattern unless the authenticated session has the project_reporting role (this requires reverse-proxy integration with the application's authentication layer).
2. Disable the export functionality entirely by removing or commenting out the route in the application's routing configuration if the feature is not business-critical.
3. Review user role assignments and ensure that users with ROLE_USER status do not have legitimate access to project reporting data. Revoke excessive permissions where possible.
4. Monitor access logs for anomalous requests to the export route from low-privilege accounts.

Patch / Upgrade Steps:

1. Monitor the Kimai release announcements for version 2.64.0, which contains the fix.
2. Upon release, apply the upgrade following standard Kimai deployment procedures (backup database, upgrade application files, run migrations, clear cache).
3. Verify the fix after upgrade by attempting to access the export route with a low-privilege account and confirming the expected authorization denial.

Long-Term Hardening:

1. Conduct a code review of any custom Kimai controllers or extensions to ensure authorization attributes are applied at the class level (or to each method individually) rather than relying on method-specific guards.
2. Implement automated security testing (SAST) as part of the CI/CD pipeline to detect inconsistent authorization guard placement.
3. Apply the principle of least privilege across all user roles; regularly audit user accounts and permissions.
4. Enable comprehensive logging and consider deploying a WAF with virtual patching capabilities to block this specific route for unauthorized roles.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-80194 (CVSS Score: 4.3, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
2. Kimai Official Website: https://www.kimai.org/ (Vendor product page; check for version 2.64.0 release notes)
3. CWE-200 Reference: https://cwe.mitre.org/data/definitions/200.html (Exposure of Sensitive Information to an Unauthorized Actor)
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No listing for CVE-2026-80194 as of this report)

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild evidence, public proof-of-concept code, or Nuclei templates have been identified for CVE-2026-80194 at the time of this report. The vulnerability is expected to be trivially exploitable by any authenticated low-privilege user once discovered in a target environment.