Leantime EUVD-2026-98850

Exploitation requires an authenticated low-privilege Leantime session (PR:L) and that the request carry the X-Requested-With: XMLHttpRequest header, which the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php requires to reach the public API service methods. The specific vulnerable methods are leantime.rpc.api.api.createApiKeyWithProjects (reaching Api::createApiKeyWithProjects, accepting an attacker-chosen role) and Plugins::installPlugin/enablePlugin/disablePlugin/removePlugin, all of which lacked a RequiresPermission attribute so PermissionEnforcer::enforce permitted them. The limiting factors are that a valid account is needed first (no unauthenticated path) and that installs must be on a version prior to 3.10.0; exposure is widened when open/self-service user registration is enabled, since that lowers the bar to obtaining the required low-privilege session.

This is a genuine priority for any organization running Leantime, not a high-CVSS-but-low-real-risk issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) is internally consistent with the description: a network-reachable JSON-RPC endpoint, trivially low attack complexity (a single crafted request with an X-Requested-With header), and only a low-privilege authenticated session required. The C:H/I:H/A:H impact is well-justified because the flaw lets an ordinary user mint an interactive administrator account, which is effectively full compromise of the application. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC flag in the data, so the status is no public exploit identified at time of analysis. The main risk-amplifying factors are the low barrier (any authenticated user, including self-registered accounts where open registration is enabled) and the vendor-confirmed root cause (missing per-method authorization in PermissionEnforcer::enforce). The main mitigating factor is that an authenticated session is required first - this is privilege escalation, not pre-auth RCE. No signals are conflicting; the primary data gap is the absence of EPSS and any independent telemetry on real-world exploitation.

A low-privilege Leantime user (or an attacker who registered or phished any ordinary account) sends a single JSON-RPC request to leantime.rpc.api.api.createApiKeyWithProjects with the X-Requested-With: XMLHttpRequest header and an attacker-chosen administrator role, creating a new interactive admin account under their control. The same missing authorization also lets them invoke Plugins::installPlugin/enablePlugin to load plugin code. No public exploit is identified at time of analysis, though the fixing commits and PRs are public and make the mechanism easy to reconstruct.