What is GHSA-w754-75mx-556q?

GHSA-w754-75mx-556q is a security advisory published by GitHub Security Advisories with High severity. Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and...

Which CVE IDs does GHSA-w754-75mx-556q cover?

GHSA-w754-75mx-556q covers the following CVE IDs: CVE-2026-80198. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w754-75mx-556q?

GHSA-w754-75mx-556q has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-w754-75mx-556qHighCVSS 7.5

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and...

Vendor

GitHub Security Advisories

Published

August 29, 2026

Last Modified

August 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-80198 →

📋 Description

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.

🔗 References (4)

https://github.com/kimai/kimai/security/advisories/GHSA-vrqv-52x7-rm4v
https://nvd.nist.gov/vuln/detail/CVE-2026-80198
https://www.vulncheck.com/advisories/kimai-before-2.56.0-information-disclosure-via-config-twig-function
https://github.com/advisories/GHSA-w754-75mx-556q