Leantime EUVD-2026-83890

Requires an authenticated Leantime account with permission to set a value that becomes a grouping label - a project name, status name, ticket type, or milestone headline (PR:L). Exploitation is limited by: (1) needing that authenticated low-privileged access rather than being unauthenticated; (2) requiring a victim to passively view the affected Kanban/list/table board (UI:P) for the stored payload to fire; and (3) applying only to Leantime up to and including 3.9.8, where the getAllGrouped() label branches render user-controlled text raw. No special non-default configuration is needed beyond normal board usage.

This is a genuine but moderate-severity issue, not a critical one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) describes a stored XSS reachable over the network but requiring an authenticated low-privileged account (PR:L) and passive victim interaction (UI:P) - a victim must simply view the Kanban/list board where the malicious label is rendered. The E:P (proof-of-concept) exploit-maturity flag is corroborated by a publicly published exploit and a merged vendor patch (PR #3767, commit a30a6837), so 'publicly available exploit code exists' is confirmed. There is no EPSS score or CISA KEV entry in the input, so there is no evidence of active exploitation - treat this as a POC-available, not exploited-in-the-wild, issue. The most important nuance: the vendor scored confidentiality as VC:N and only VI:L, but the public exploit is titled 'Stored XSS in Leantime Kanban Swimlane Headers Enables Privilege Escalation to Owner,' implying script execution in a higher-privileged (Owner) session - the real impact plausibly includes session/action hijacking beyond the low integrity impact scored. Net: prioritize as a standard authenticated stored-XSS with a privilege-escalation angle; patch promptly but it is not an emergency network-unauthenticated RCE.

A low-privileged authenticated Leantime user sets a project, status, or ticket-type name containing a malicious HTML/JS payload, which getAllGrouped() embeds unescaped into a Kanban swimlane or list/table accordion header label. When a higher-privileged user (e.g., a project Owner) opens that board, the script executes in their session, enabling privilege escalation. A public proof-of-concept for this exact swimlane-header vector has been published.