Json Rpc Api
Monthly
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.