CVE-2026-80194

MEDIUM 4.3

Kimai before 2.64.0 Missing Authorization via ProjectViewController export

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.

CWE	CWE-200
Vendor	kimai
Product	kimai
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for kimai kimai

Be the first to know when new medium vulnerabilities affecting kimai kimai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

kimai / kimai

0 < 2.64.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kimai/kimai/security/advisories/GHSA-pvc4-crg3-gj44 vulncheck.com: https://www.vulncheck.com/advisories/kimai-before-2.64.0-missing-authorization-via-projectviewcontroller-export

Credits

🔍 devzephyr