CVE-2026-80194

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.64.0

Description An authorization failure exists in the report project view export export route within the ProjectViewController. Because authorization guards are applied to the invoke() function instead of the class level, the export route lacks necessary authorization checks. This allows any authenticated user, including those with only ROLE USER and lacking the project reporting permission, to download the project overview export. This action discloses customer names, project names, currency, budget type, and aggregate totals across all customers, although actual financial figures remain protected.

Recommendations Update Kimai to version 2.64.0 or later.