CVE-2026-80194 kimai CVE debrief

Who should care

Organizations using Kimai versions before 2.64.0 should prioritize patching this vulnerability to prevent unauthorized access to sensitive project data exports. Authenticated users with limited permissions may be able to access exports containing sensitive information, which could lead to data breaches or other security incidents.

Technical summary

The ProjectViewController export route in Kimai before 2.64.0 lacks proper authorization, allowing authenticated users with limited permissions to access sensitive project data exports. The vulnerability is due to authorization guards being attached to the sibling __invoke method instead of at the class level. This enables any authenticated user, including those with the ROLE_USER without project_reporting permission, to download project overview exports containing sensitive information such as customer names, project names, currency, budget type, and aggregate totals across all customers.

Defensive priority

Authenticated users with limited permissions can access sensitive project data exports.

Recommended defensive actions

• Inventory and verify Kimai installations to identify potential exposure.
• Restrict access to the ProjectViewController export route.
• Implement proper authorization checks for the export functionality.
• Monitor for suspicious activity related to project data exports.
• Update Kimai to version 2.64.0 or later.

Evidence notes

The CVE-2026-80194 record indicates a missing authorization vulnerability in Kimai before version 2.64.0. The vulnerability affects the ProjectViewController export route, allowing any authenticated user, including those with the ROLE_USER without project_reporting permission, to download project overview exports containing sensitive data such as customer names, project names, currency, budget type, and aggregate totals. However, actual financial figures remain protected in the export template. The CVSS score is 8.7, indicating a HIGH severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.