CVE-2026-80201

Executive Summary

CVE-2026-80201 is a server-side template injection vulnerability of the CWE-94 class affecting Kimai — a popular open-source time-tracking application — in all versions prior to 2.53.0. The flaw stems from an incomplete sandbox in the Twig invoice template engine, which fails to block sensitive User object methods (specifically getApiToken() and getPlainApiToken()) from being invoked by authenticated users with template-creation permissions. An attacker who can create or modify invoice templates can embed calls to these methods, causing the application to render the hashed API tokens directly into the invoice output. Despite the low CVSS score of 2.0, this vulnerability exposes credential-bearing hashes to unauthorized parties and can chain with other issues to enable lateral movement or account takeover.

Technical Analysis

Vulnerability Class: CWE-94 — Improper Control of Generation of Code ("Code Injection")

Affected Component: Twig Invoice Template Sandbox

Kimai uses the Twig templating engine to render invoice templates. Twig supports a sandbox extension that restricts which methods and properties can be accessed within templates, providing a security boundary between template code and the underlying application object model. In affected versions (< 2.53.0), this sandbox is configured with an allowlist that fails to enumerate and block sensitive methods exposed by the User entity class.

The NVD description names two specific methods that can be reached through the sandbox gap:

• getApiToken() — returns a hashed representation of the user's API token
• getPlainApiToken() — returns the plain/unhashed API token

The attack surface is the invoice template creation/modification workflow. Users with privileges to create or edit invoice templates can insert Twig expressions such as {{ user.getApiToken() }} or {{ user.getPlainApiToken() }} into the template body. When the invoice is generated/rendered, the Twig engine evaluates these expressions, and the returned token values are embedded in the resulting PDF/HTML/rendered invoice output.

Technical mechanism: The sandbox in Twig operates by intercepting property/method access on objects and comparing against an allowlist of permitted methods (commonly implemented via Twig_Sandbox_SecurityPolicy::checkMethodAllowed()). The gap here is an incomplete allowlist — the sandbox simply does not include entries for these two User-related methods, so the security policy does not flag the access as forbidden.

Attack surface prerequisites:

1. Valid authentication as a user with template creation permissions
2. Ability to save a malicious template
3. Ability to trigger invoice generation (either directly or by convincing another user to do so)

Limitations: The CVSS vector indicates high attack complexity (AC:H) and high privileges required (PR:H). Not all user roles are able to edit templates — only administrators or role holders explicitly granted template permissions. The exploit requires user interaction (UI:R) for delivery, meaning the attacker must rely on another user to generate an invoice from the malicious template, or the attacker must be able to generate invoices themselves.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2026-80201. The following attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance / Target Identification: The attacker identifies a Kimai installation (version < 2.53.0) via Shodan or fingerprinting of the login page. The attacker enumerates users with admin privileges, or compromises an account that has the "Create Invoice Template" permission. Successful identification requires only network access to the application.

Step 2 — Flaw Trigger: The attacker creates a new invoice template or modifies an existing one. In the template body, they inject a Twig expression that invokes the exposed method on the User object. Based on the NVD description, the attacker can inject expressions to invoke getApiToken() or getPlainApiToken(). The attacker saves this template.

Step 3 — Payload / Execution: The template is executed at invoice-rendering time. Since methods like getPlainApiToken() would return the raw API token, the rendered invoice output (through the normal invoice generation workflow) will contain the token value in the rendered document. The attacker who triggered invoice generation — or anyone who views the rendered invoice — can extract the token.

Step 4 — Post-Exploitation Impact: With the obtained API token, the attacker can authenticate to the Kimai REST API as the token's owner. If the token has high privileges (e.g., belongs to an administrator), the attacker can potentially perform further actions — modifying time records, accessing all users' data, or escalating privileges further. Since the plain token allows direct API access, the attacker bypasses the need for standard authentication.

Impact Assessment

CVSS Breakdown (derived from vector CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N):

• Attack Vector: Network — Exploitable remotely without physical access
• Attack Complexity: High — Requires specific conditions and template editing privileges
• Privileges Required: High — Attacker needs an account with template permissions
• User Interaction: Required — A user must generate the invoice
• Scope: Unchanged — Impact confined to the vulnerable component
• Confidentiality: Low — Token leakage only; no data modification

Business Impact:

• Credential Exposure: The vulnerability leaks hashed or plain API tokens. This is a serious concern because API tokens are long-lived credentials. Once leaked, they can be used to impersonate the user and access the API without further authentication.
• Lateral Movement Potential: A stolen administrator API token could be used to access other systems that integrate with Kimai via the API.
• Compliance: If Kimai processes data under GDPR or similar regulations, a credential leak could constitute a reportable incident.
• Blast Radius: This is limited to installations that (a) use templates, (b) have multiple users with template permissions, and (c) have configured API access. For single-admin deployments, the risk is minimal.

Realistic assessment: The low CVSS score (2.0) accurately reflects the limited direct impact (confidentiality, low) and the high preconditions. However, in practice, the real-world risk depends heavily on the deployment configuration and what tokens protect.

Detection Guidance

Sigma Rule

This rule detects suspicious Twig template modifications or invoice generation with suspicious patterns indicative of API token access.

title: Kimai Twig Template Script Injection Attempt (CVE-2026-80201)
id: 3c1ec3a8-9150-4d4b-bea8-7f9a64a9c12e
status: experimental
description: Detects attempts to exploit CVE-2026-80201 by injecting Twig template expressions calling sensitive User API token methods.
author: Valters IT Research
logsource:
    category: application
    product: kimai
detection:
    selection:
        message|contains|all:
            - 'getApiToken'
            - 'getPlainApiToken'
            - 'invoice'
            - 'template'
    condition: selection
fields:
    - user
    - source_ip
    - timestamp
falsepositives:
    - Legitimate administrator testing
level: high
tags:
    - attack.t1204
    - attack.t1078
    - cve.2026-80201

YARA Rule

This rule scans for strings embedded in stolen invoice files or malicious templates.

rule KIMAI_TWIG_SANDBOX_BYPASS_CVE_2026_80201
{
    meta:
        author = "Valters IT Research"
        description = "Detects exposed Kimai API token hashes in rendered invoice files or malicious templates"
        cve = "CVE-2026-80201"
        created = "2026-02-15"
    strings:
        $s1 = "getApiToken" ascii wide nocase
        $s2 = "getPlainApiToken" ascii wide nocase
        $s3 = "{{" ascii
        $s4 = "}}" ascii
        $s5 = "user" ascii wide nocase
    condition:
        uint16(0) == 0x5B25 and // "%[" for PDF files
        all of ($s1, $s2, $s3, $s4) and
        1 of ($s5)
}

Suricata IDS Rule

Detects network traffic containing attempts to access the Kimai invoice template editing endpoint with typical template injection payloads.

alert http any any -> $HOME_NET any (msg:"KIMAI - CVE-2026-80201 Twig Template Injection Attempt";
flow:established,to_server;
content:"invoice"; http_uri; nocase;
content:"template"; http_uri; nocase;
pcre:"/(getApiToken|getPlainApiToken)/i";
sid:8020101; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, cve CVE-2026-80201;
reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-80201;
classtype:attempted-admin;
)

Elastic Detection

EQL query to detect access to the template creation endpoints combined with the token method strings in web traffic or application logs.

// EQL - Detect successful template injection attempts in web logs
sequence by source.ip, user.name
  [network where process.name == "nginx" and
   url.path contains "invoice" and
   url.path contains "template" and
   method == "POST"]
  [process where event.action == "kibana-log" or
   (source.data contains "getApiToken" or source.data contains "getPlainApiToken")]

Splunk SPL Query

Index: web (nginx or apache) or application logs.

index=web sourcetype=access_combined
    (uri="*/invoice/template*" OR uri="*/invoice/*template*")
    OR index=application sourcetype=application_log
    (message="*getApiToken*" OR message="*getPlainApiToken*")
    OR (uri=*/invoice* AND form_data=*getApiToken*)
| stats count by src_ip, user, uri, status
| where count > 1

Wazuh OSSEC Rule

<group name="kimai,">
  <rule id="317958" level="12">
    <decoded_as>json</decoded_as>
    <field name="message" type="pcre2">get(Api|PlainApi)Token</field>
    <description>Kimai CVE-2026-80201 - Twig sandbox bypass: API token method call detected in invoice template</description>
    <mitre>
      <id>T1204</id>
      <id>T1078</id>
    </mitre>
    <group>cve-2026-80201,kimai,</group>
    <info type="cve">CVE-2026-80201</info>
  </rule>
  <rule id="317959" level="10">
    <decoded_as>json</decoded_as>
    <field name="url_path" type="pcre2">/invoice/(edit|new)</field>
    <description>Kimai invoice template modification attempt</description>
    <group>cve-2026-80201,kimai,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor fix is not yet available in the tracked data.

1) Immediate Mitigations

• Restrict invoice template permissions: Ensure that only absolutely trusted administrators have permission to create or edit invoice templates. Review the role assignments and remove template editing capabilities from any account that does not require them.
• Enforce least privilege for API tokens: If deployment uses API tokens, rotate them regularly. Consider disabling API access entirely if not actively used.
• Review existing templates: Audit all existing invoice templates for any suspicious Twig expressions, especially ones that reference User, getApiToken, or getPlainApiToken. Remove any that are not needed.
• Monitor rendered invoice output: If a trusted source provides a suspicion that templates have been tampered with, review all recently generated invoices for any string resembling a hash or token value.
• Upgrade if possible: Monitor for a fixed version. Upgrade to the latest available release as soon as a fix is available in version 2.53.0 or beyond.

2) Patch / Upgrade Steps

• Check the current Kimai version with bin/console kimai:version or the admin panel.
• Wait for the official 2.53.0+ release containing the fix.
• Once available, follow the standard Kimai upgrade procedure: backup database and files, run composer install with the new version, run bin/console doctrine:migrations:migrate, then clear cache (bin/console cache:clear).
• Verify version after migration.

3) Long-Term Hardening

• Keep Kimai updated: Subscribe to the vendor's release announcements to receive timely notifications.
• Least privilege everywhere: Reduce the number of admin/template-manager accounts. Implement role-based access control with minimal necessary permissions.
• Input validation: If custom templates are used, establish a review process before deployment.
• Network segmentation: Place the Kimai instance behind a reverse proxy with Web Application Firewall (WAF) rules that can detect template injection patterns.
• Logging and monitoring: Ensure audit logging is enabled and that logs capture template modifications, invoice generation, and API usage.
• API token rotation policy: Establish a recurring token rotation schedule, especially for high-privilege accounts.

References

1. NVD Entry: CVE-2026-80201 — National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-80201
2. Vendor Product: Kimai — Time Tracking Application: https://www.kimai.org
3. Kimai GitHub Repository (source code review location for Twig sandbox configuration): https://github.com/kimai/kimai
4. CWE-94 — Code Injection: http://cwe.mitre.org/data/definitions/94.html
5. ATT&CK T1204 — User Execution: https://attack.mitre.org/tactics/TA0002

Threat Actor / Exploitation-in-the-Wild Evidence: No known threat actor campaigns or exploitation in the wild have been reported for CVE-2026-80201 as of the report date. No PoC or exploit code is publicly available. The vulnerability is currently only theoretical in impact, with risk increasing if API tokens are used for other system integrations. Monitoring for future activity is recommended, as template injection flaws are commonly weaponized within 3–6 months of disclosure.