Kimai versions prior to 2.56.0 contain a vulnerability in the Twig sandbox policy that allows the config() Twig function to access and leak server-wide secrets such as LDAP bind passwords and SAML SP private keys. This occurs because the config() function performs unrestricted key lookups on the flattened kimai.config container, exposing sensitive configuration values to any admin user who can upload invoice or export templates. These secrets can then be exfiltrated by lower-privileged users who generate invoices or exports using the malicious templates.