Leantime CVE-2026-76647

Exploitation requires the attacker to hold a valid authenticated session in the Leantime instance at any privilege level (PR:L per CVSS vector). The JSON-RPC API endpoint must be network-accessible - if the application is internet-exposed, so is this attack surface. No additional non-default configuration is required; the JSON-RPC dispatcher is a core component of the application. The limiting factor is the requirement for a pre-existing valid account: pure unauthenticated external attackers cannot exploit this directly, but any invited user, guest, or compromised low-privilege account is sufficient. There is no required user interaction from the victim. Accounts on internal-only Leantime deployments face reduced but non-zero risk if insider threat or account compromise is in scope.

The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity: network-accessible, low complexity, requiring only a valid low-privilege account. EPSS at 0.17% (6th percentile) signals very low near-term automated exploitation probability, but this metric lags disclosure and does not account for targeted misuse. There is no KEV listing confirming active exploitation. However, VokeCyber's published blog and research posts provide sufficient technical detail to lower the exploitation barrier substantially - this is effectively a blueprint for exploitation even if no standalone POC binary is confirmed. The ability to take over administrator accounts from a low-privilege authenticated position is a high-impact lateral escalation path in any multi-tenant deployment. The pattern of related CVEs (CVE-2026-59712, CVE-2026-15509) suggests systemic authorization gaps, raising concern that additional unpatched vectors exist. Real-world priority is moderate-to-high for any deployment where untrusted users hold accounts, such as client-facing or multi-tenant Leantime instances.

An authenticated low-privilege Leantime user - such as a guest or project member - sends a crafted JSON-RPC POST request to the /api/jsonrpc endpoint calling the editOwn method with a victim administrator's user ID substituted in the payload. Because the dispatcher invokes the service-layer method without verifying that the supplied user ID matches the session owner, the service sets a new attacker-controlled password for the administrator account. The attacker then authenticates as that administrator, achieving full platform takeover. VokeCyber's published research provides sufficient technical specificity to reproduce this attack without additional reverse engineering.