Description

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.0",
  "pubDate": "2026-08-26T05:18:27.830Z",
  "pubdate": "2026-08-26T05:18:27.830Z",
  "executiveSummary": "Kimai versions prior to 2.53.0 are susceptible to an improper sandbox configuration vulnerability within its Twig invoice template engine.\nThe vulnerability arises from a failure to adequately restrict access to sensitive methods within the template sandbox environment.\nThis security flaw allows authenticated users possessing invoice template creation permissions to invoke privileged object methods, specifically getApiToken() and getPlainApiToken().\nSuccessful exploitation enables unauthorized disclosure of sensitive security credentials, namely hashed API tokens, which are otherwise intended to remain protected.\nThe impact is significant, as an attacker can exfiltrate these tokens via the rendered output of manipulated invoice templates.\nThe vulnerability requires an attacker to hold permissions to manage or create invoice templates, limiting the initial vector to privileged internal users or compromised accounts with such rights.\nThis flaw presents a risk of unauthorized API access, potentially leading to privilege escalation or further exploitation of the Kimai instance depending on the scope and permissions associated with the leaked API tokens.",
  "technicalDetails": "The vulnerability exists within the Twig invoice template rendering engine of Kimai, which utilizes a sandboxing mechanism to restrict template authors from accessing arbitrary methods or properties of the underlying PHP objects.\nThe root cause is a failure in the sandbox configuration to explicitly blacklist sensitive methods within the User entity objects available to the template context.\nSpecifically, the methods 'getApiToken()' and 'getPlainApiToken()' remain accessible within the restricted sandbox environment.\nThe attack flow begins when an attacker, who has been granted sufficient privileges to create or edit invoice templates, inserts a malicious Twig expression into a template file.\nWhen the invoice is rendered, the Twig engine processes the expression by calling the unauthorized methods on the User object context provided to the template.\nBecause the sandbox fails to block these calls, the engine executes the methods, retrieves the internal API token (or its hash), and includes the value directly in the generated output (e.g., an HTML or PDF invoice).\nThe attacker can then trigger the rendering of the malicious template—for instance, by generating an invoice for a target user—and inspect the resulting output to retrieve the sensitive token.\nThis effectively bypasses the intended security boundary of the Twig sandbox, allowing for the direct extraction of sensitive authentication material that should be inaccessible to the template layer.\nThe vulnerability is present in all Kimai versions prior to 2.53.0.\nExploitation requires authenticated access to the application with permissions sufficient to modify invoice templates.\nThe impact is the unauthorized disclosure of API credentials, which can be leveraged to impersonate users via the Kimai API, potentially leading to further data exfiltration, unauthorized administrative actions, or total account compromise if the token belongs to an administrator."
}