Kimai Guarded the Report and Forgot the Export
Kimai locked its project report behind a permission check and left the export route beside it open. Any logged-in user could download customer names, project names, and budget metadata across every customer. Advisory GHSA-pvc4-crg3-gj44, CVE-2026-80194, patched in 2.64.0.