Skip to content
OpenAdvisories

Vendor

Kimai Project

38 known vulnerabilities.

Products

kimai 38
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.0
    CVE-2026-80201

    Kimai before 2.53.0 API Token Leakage via Invoice Template

    Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice template…

    Kimai Project kimai kimai/kimai Packagist
  • Low 3.7
    CVE-2026-80199

    Kimai before 2.54.0 Username Enumeration via Timing Oracle

    Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for …

    Kimai Project kimai kimai/kimai Packagist
  • Low 3.3
    CVE-2026-41498

    Kimai: Team API Missing Object-Level Authorization

    Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership che…

    Kimai Project kimai kimai/kimai Packagist