Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to… (CVE-2026-80198)

Kimai versions prior to 2.56.0 fail to restrict the config() function within sandboxed Twig templates used for invoices and exports. This flaw permits users with administrative privileges to craft and upload malicious templates that can read arbitrary configuration keys. Consequently, sensitive secrets including LDAP bind credentials and SAML private keys can be exposed through generated invoice or export documents, potentially accessible by users with lesser privileges.

An attacker with administrator privileges can exploit this vulnerability to extract sensitive configuration data, including LDAP bind passwords and SAML private keys, by uploading malicious templates. This leads to unauthorized disclosure of critical secrets, potentially compromising authentication systems and server security. The vulnerability does not affect confidentiality beyond configuration data and does not impact integrity or availability directly.

A fix is available in Kimai version 2.56.0. Users should upgrade to version 2.56.0 or later to remediate this vulnerability. No other mitigations are indicated in the advisory.