Leantime CVE-2026-66416

Exploitation requires that (1) the target runs a Leantime version with the VerifyCsrfToken middleware commented out of HttpKernel.php (confirmed for 3.6.2, the default/shipped state), and (2) a victim who is currently authenticated to that Leantime instance is lured to load attacker-controlled content in the same browser - this is the CVSS UI:A / user-interaction requirement and is the primary limiting factor. No attacker credentials are needed (PR:N), and no non-default configuration is required because CSRF protection is disabled out of the box; the JSON-RPC API is additionally exempt (api/* in VerifyCsrfToken.php), widening the reachable endpoints. Exploitation is limited by the need for an active, valid victim session and successful social engineering, so it is not fully hands-off/automatable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, score 8.6) is internally consistent with a CSRF flaw: network reachable, low complexity, no attacker privileges, but requiring active user interaction (the victim must load a malicious page). High confidentiality/integrity/availability impact reflects that forged requests can delete projects and change permissions. The signals partly converge: a public POC exists and a trusted reporter (VulnCheck) documented it, which raises real-world credibility, but the vulnerability is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The practical limiter is UI:A - exploitation depends on socially engineering an already-authenticated user to visit attacker content, making this opportunistic/targeted rather than mass-automatable. Net: a genuine, well-substantiated priority for any internet-exposed Leantime instance, but the required user interaction keeps it below a wormable/unauthenticated-RCE tier.

An attacker sends a phishing email or lures a logged-in Leantime user to a malicious web page containing an auto-submitting hidden form (or JSON-RPC fetch) targeting the victim's Leantime instance. Because the server enforces no CSRF token and trusts the session cookie, the browser silently issues an authenticated POST/PUT/DELETE that deletes a project or elevates the attacker's permissions. Public exploit code (GHSA-x8vx-9g5w-w5rr) demonstrates the technique, and the low attack complexity means the forged request succeeds as soon as the victim's browser loads the page.