Kimai versions before 2.53.0 are vulnerable because the Twig invoice template sandbox does not block sensitive User methods. Admin users who can create or modify invoice templates can add method calls that expose API tokens through the rendered invoice. This allows an attacker to obtain hashed API tokens, which can be used to authenticate or impersonate the victim's account. The underlying weakness is a failure to enforce sandbox restrictions and is associated with CWE‑94.

The affected systems are Kimai installations running any version older than 2.53.0. The vulnerability applies to all users who have permission to create or edit invoice templates within the application. Version information from the CNA lists all releases prior to 2.53.0 as susceptible.

The CVSS score of 2 indicates low overall severity; however, the impact is the disclosure of API credentials. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an internal attacker or a compromised administrative account that can add custom templates. The exploit does not require any code execution beyond inserting method calls in the template, making it simple to carry out for anyone with template creation privileges.