Which versions of Leantime are affected by CVE-2026-59712?

A credential disclosure vulnerability in Leantime's API (CVE-2026-59712, CVSS 8.6) permits authenticated users to extract password hashes, TOTP secrets, and session tokens for any user account,…. A patch is available.

How to fix or mitigate CVE-2026-59712?

24 hours: Apply vendor patch to Leantime across all instances. 7 days: Verify successful patch deployment and review API access logs for unauthorized calls to the users.getUser method during pre-patch period. 30 days: Conduct password resets for any accounts showing suspicious activity; validate that API access controls are properly enforced.

Leantime CVE-2026-59712

Q: What is the CVSS score of CVE-2026-59712?

CVE-2026-59712 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41942 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-06 VulnCheck

GHSA-hphp-fmhr-5fqh

Authentication Bypass Leantime

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated (PR:L) network call with no interaction reads all credentials, so C:H; the flaw itself only discloses data (takeover is downstream), so I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 21:38 vuln.today

DescriptionCVE.org

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

AnalysisAI

Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row - password hashes, TOTP secrets, and session tokens - by invoking the users.getUser method with arbitrary user IDs (CWE-639, broken object-level authorization). Because the API returns records without verifying the caller owns or is authorized for the requested ID, a low-privileged user can enumerate and harvest credentials for every account, including administrators. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.6 (High).

Technical ContextAI

Leantime is a self-hosted, open-source project-management and productivity application (PHP-based) that exposes a JSON-RPC API. The affected component is the Users::getUser method reachable via the users.getUser RPC call. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the method trusts a user-supplied user ID and returns the corresponding database row without checking whether the authenticated caller is permitted to access that record. Critically, the returned object is the raw user row rather than a sanitized view, so sensitive columns - bcrypt/hashed passwords, TOTP two-factor secrets, and active session tokens - are exposed. The single affected CPE is cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*, indicating all versions prior to the fix are in scope.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor fix delivered in commit 4f2612d13e0e8a2093092a846b44506cf133b671 (https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671) by upgrading to the corresponding patched release once your version is confirmed to include it. If you cannot patch immediately, restrict network exposure of the JSON-RPC API endpoint (for example, block or firewall external access to the RPC route so only trusted networks reach it) and disable or tightly restrict self-registration to limit who can obtain the low-privileged account needed to call the method; note that restricting the API may break integrations that rely on it. Because session tokens and 2FA secrets may already be exposed, after patching also force a global password reset, rotate/invalidate all session tokens, and re-enroll TOTP secrets for all users. Track remediation via issue https://github.com/Leantime/leantime/issues/3556 and the advisory https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method.