CyberRota Analysis
AI-GeneratedKimai versions prior to 2.53.0 are vulnerable due to inadequate restrictions on sensitive User methods within the Twig invoice template sandbox. This flaw allows attackers with template creation permissions to exploit the system by embedding calls to getApiToken() and getPlainApiToken(), potentially exposing hashed API tokens in the rendered invoices. Organizations using Kimai, particularly those with user roles that allow template creation, should prioritize addressing this vulnerability to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.