Kimai leaks API Token Hash via Invoice Twig Template
Date: 2026-04
Affected: composer/kimai/kimai
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-184
CWE-601
CVSS: 2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N)

## Summary The Twig sandbox used for invoice templates blocks certain sensitive `User` methods (password, TOTP secret, etc.) via a blocklist in `StrictPolicy::checkMethodAllowed()`. However, `getApiToken()` and `getPlainApiToken()` are not on the blocklist. An admin who creates an invoice template can embed calls to these methods, causing the bcrypt or sodium hashed API password of any user who generates an invoice using that template to be included in the rendered output. Only relevant for OnPremise installations with template upload activated. ## Background Kimai allows admins (`ROLE_ADMIN` and above) with the `manage_invoice_template` permission to create Twig-based invoice templates. These templates are rendered in a sandboxed Twig environment with `StrictPolicy` controlling which methods and properties are accessible. `StrictPolicy` explicitly blocks: ```php // src/Twig/SecurityPolicy/StrictPolicy.php:156 if (\in_array($lcm, [ 'getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration' ], true)) { throw new SecurityNotAllowedMethodError(...); } ``` `getApiToken()` and `getPlainApiToken()` are **not** in this list and are freely callable. ## Vulnerable Code `StrictPolicy.php` — missing entries in the User method blocklist: ```php // Current ['getpassword', 'gettotpsecret', 'getplainpassword', 'getconfirmationtoken', 'gettotpauthenticationconfiguration'] // Should also include: 'getapit


Mitigations:

Architectural layers (MAESTRO):