Missing Authorization in kimai2 - CVE-2026-80194
Published: August 13, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU142430
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80194
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in ProjectViewController::export when handling requests to the report_project_view_export route. A remote user can send a request to the export endpoint to disclose sensitive information.
The exposed data can include customer names, project names, currency, budget type, and aggregate totals, while financial figures remain protected.
Affected software
kimai2
How to mitigate CVE-2026-80194
Install security update from vendor's website.
kimai2 - update to 2.64.0