EUVD-2026-49063
GHSA-p3jw-q4jg-x8w9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
AnalysisAI
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in th
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server in
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted P
Leantime is an open source project management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely e
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do ti
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUr
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. Rated high severity (CVSS 8.8), this vu
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Rated medium severity (CVSS 4.7),
Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today