EUVD-2026-53193
GHSA-j9c4-c6g5-c9fv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible RPC requires only a valid user session (PR:L); reading TOTP secrets yields C:H and disabling 2FA yields I:H, with no availability impact and no scope change.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher). Any authenticated user can invoke getSetupData with an arbitrary userId to read that user's live TOTP secret, or disable2FA to strip another account's two-factor authentication entirely, fully defeating account-level 2FA protection. This is related to CVE-2026-15509, which covers a similar missing-authorization pattern in the JSON-RPC editUser/addUser role-assignment path in the same application; the TwoFA service methods addressed here are a distinct, independently fixable set of RPC endpoints.
AnalysisAI
Horizontal privilege escalation in Leantime through 3.6.2 allows any authenticated user to read live TOTP secrets or strip two-factor authentication from arbitrary accounts via unenforced JSON-RPC endpoints, fully defeating per-account 2FA protection. The four affected methods - getSetupData, saveSecret, verifyAndEnable, and disable2FA - accept a caller-supplied userId with no ownership check, session pinning, or permission gate, unlike other methods in the same RPC dispatcher. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in Leantime (PR:L) - any registered user account suffices; no elevated role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 8.1, reflecting a network-reachable flaw requiring only low-privilege authentication, no interaction, and yielding high confidentiality (TOTP secret disclosure) and high integrity (ability to disable another account's 2FA) impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged Leantime user (e.g., a contractor or team member) sends a crafted JSON-RPC request to leantime.rpc.TwoFA.TwoFA.getSetupData with a target administrator's userId, receiving that admin's live TOTP secret in the response. The attacker registers the secret in a TOTP app and subsequently calls disable2FA for the same userId, removing 2FA from the admin account entirely, leaving it protected only by its password. |
| Remediation | No vendor-released patched version has been identified at time of analysis - the sole reference points to the upstream GitHub repository at https://github.com/Leantime/leantime rather than a specific advisory or tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Leantime in production and confirm if versions through 3.6.2 are deployed; if vulnerable, document the user count and access privileges of all accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in th
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server in
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted P
Leantime is an open source project management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely e
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do ti
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUr
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. Rated high severity (CVSS 8.8), this vu
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Rated medium severity (CVSS 4.7),
Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row
Login CSRF (session fixation) in Leantime's OpenID Connect authentication flow allows an attacker to authenticate a vict
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today