Leantime
Monthly
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.
Horizontal privilege escalation in Leantime through 3.6.2 allows any authenticated user to read live TOTP secrets or strip two-factor authentication from arbitrary accounts via unenforced JSON-RPC endpoints, fully defeating per-account 2FA protection. The four affected methods - getSetupData, saveSecret, verifyAndEnable, and disable2FA - accept a caller-supplied userId with no ownership check, session pinning, or permission gate, unlike other methods in the same RPC dispatcher. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low exploitation complexity (authenticated, network-accessible, no user interaction) makes it a credible lateral-escalation risk in any multi-user Leantime deployment.
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server into reading attacker-chosen resources by feeding unsanitized filenames to file_get_contents() inside the Blueprints::import() method. Because the JSON-RPC import endpoint accepts PHP URL wrappers and path-traversal sequences, a low-privileged user with project CREATE rights can pivot to cloud metadata endpoints (e.g. 169.254.169.254) or exfiltrate arbitrary files from the host filesystem. Publicly available exploit code exists (VulnCheck advisory and a GitHub security advisory PoC), though there is no public exploit identified as being actively exploited in the wild.
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row - password hashes, TOTP secrets, and session tokens - by invoking the users.getUser method with arbitrary user IDs (CWE-639, broken object-level authorization). Because the API returns records without verifying the caller owns or is authorized for the requested ID, a low-privileged user can enumerate and harvest credentials for every account, including administrators. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.6 (High).
Login CSRF (session fixation) in Leantime's OpenID Connect authentication flow allows an attacker to authenticate a victim into an attacker-controlled account. The root cause is a stubbed verifyState() method that unconditionally returns true, so the OIDC state parameter is never validated, letting a crafted callback URL carrying an attacker-supplied authorization code complete login as the attacker. No public exploit identified at time of analysis, but a vendor patch and a public technical advisory (VulnCheck) exist; CVSS 4.0 is rated 8.6 (High).
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUrl` POST parameter bypasses PHP's `FILTER_SANITIZE_URL` validation - which strips illegal characters but never performs origin-validation - to redirect authenticated users to external attacker-controlled sites. Affected are all deployments of Leantime 3.6.2 with a web-accessible login endpoint, the primary use case being phishing and credential theft by abusing the trusted Leantime domain as a delivery vehicle. No public exploit is confirmed in CISA KEV, but publicly available exploit code exists per VulnCheck and a GitHub Security Advisory (GHSA-wprg-q8m6-jhp9).
Broken access control in Leantime's API component (versions up to 3.8.0) allows authenticated low-privileged users to invoke the Setting::saveSetting function and modify application settings beyond their authorization level. The flaw is classified under CWE-285 (Improper Authorization) and is tagged as an authentication bypass and broken access control issue, meaning the application fails to enforce permission boundaries after login. A publicly available proof-of-concept exploit exists per VulDB and bytium.com; no CISA KEV listing was identified at time of analysis, and the vendor has not responded to disclosure.
Privilege escalation in Leantime up to 3.8.0 allows authenticated low-privileged users to elevate their role to owner by manipulating the role argument in JSON-RPC requests to the editUser/addUser endpoint. The server fails to verify whether the calling user is authorized to assign elevated roles, a CWE-285 Improper Authorization flaw. A public proof-of-concept exploit has been disclosed, and the vendor did not respond to coordinated disclosure, meaning no patch is confirmed available.
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Leantime is an open source project management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Leantime is a lean open source project management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.
Horizontal privilege escalation in Leantime through 3.6.2 allows any authenticated user to read live TOTP secrets or strip two-factor authentication from arbitrary accounts via unenforced JSON-RPC endpoints, fully defeating per-account 2FA protection. The four affected methods - getSetupData, saveSecret, verifyAndEnable, and disable2FA - accept a caller-supplied userId with no ownership check, session pinning, or permission gate, unlike other methods in the same RPC dispatcher. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low exploitation complexity (authenticated, network-accessible, no user interaction) makes it a credible lateral-escalation risk in any multi-user Leantime deployment.
Cross-site request forgery in Leantime 3.6.2 lets a remote unauthenticated attacker execute state-changing actions in the session of any logged-in user because the Laravel VerifyCsrfToken middleware was commented out of the global middleware stack in HttpKernel.php, leaving every POST/PUT/DELETE endpoint token-free. A victim who is authenticated and visits an attacker-controlled page can be forced to create or delete projects, alter settings, and change permissions. Publicly available exploit code exists (GHSA-x8vx-9g5w-w5rr) and the flaw was reported by VulnCheck, though there is no public exploit identified as actively exploited (not in CISA KEV); EPSS was not provided.
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server into reading attacker-chosen resources by feeding unsanitized filenames to file_get_contents() inside the Blueprints::import() method. Because the JSON-RPC import endpoint accepts PHP URL wrappers and path-traversal sequences, a low-privileged user with project CREATE rights can pivot to cloud metadata endpoints (e.g. 169.254.169.254) or exfiltrate arbitrary files from the host filesystem. Publicly available exploit code exists (VulnCheck advisory and a GitHub security advisory PoC), though there is no public exploit identified as being actively exploited in the wild.
Authenticated users in Leantime 3.6.2 and earlier can bypass project access controls to read milestone data from any project on the instance. By supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint, an attacker can enumerate and retrieve sensitive project planning information, including titles, descriptions, and timelines, without membership. A fix is available; exploitation details are public but no active exploitation has been reported.
Credential disclosure in Leantime's JSON-RPC API allows an authenticated user to read any account's full credential row - password hashes, TOTP secrets, and session tokens - by invoking the users.getUser method with arbitrary user IDs (CWE-639, broken object-level authorization). Because the API returns records without verifying the caller owns or is authorized for the requested ID, a low-privileged user can enumerate and harvest credentials for every account, including administrators. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.6 (High).
Login CSRF (session fixation) in Leantime's OpenID Connect authentication flow allows an attacker to authenticate a victim into an attacker-controlled account. The root cause is a stubbed verifyState() method that unconditionally returns true, so the OIDC state parameter is never validated, letting a crafted callback URL carrying an attacker-supplied authorization code complete login as the attacker. No public exploit identified at time of analysis, but a vendor patch and a public technical advisory (VulnCheck) exist; CVSS 4.0 is rated 8.6 (High).
Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUrl` POST parameter bypasses PHP's `FILTER_SANITIZE_URL` validation - which strips illegal characters but never performs origin-validation - to redirect authenticated users to external attacker-controlled sites. Affected are all deployments of Leantime 3.6.2 with a web-accessible login endpoint, the primary use case being phishing and credential theft by abusing the trusted Leantime domain as a delivery vehicle. No public exploit is confirmed in CISA KEV, but publicly available exploit code exists per VulnCheck and a GitHub Security Advisory (GHSA-wprg-q8m6-jhp9).
Broken access control in Leantime's API component (versions up to 3.8.0) allows authenticated low-privileged users to invoke the Setting::saveSetting function and modify application settings beyond their authorization level. The flaw is classified under CWE-285 (Improper Authorization) and is tagged as an authentication bypass and broken access control issue, meaning the application fails to enforce permission boundaries after login. A publicly available proof-of-concept exploit exists per VulDB and bytium.com; no CISA KEV listing was identified at time of analysis, and the vendor has not responded to disclosure.
Privilege escalation in Leantime up to 3.8.0 allows authenticated low-privileged users to elevate their role to owner by manipulating the role argument in JSON-RPC requests to the editUser/addUser endpoint. The server fails to verify whether the calling user is authorized to assign elevated roles, a CWE-285 Improper Authorization flaw. A public proof-of-concept exploit has been disclosed, and the vendor did not respond to coordinated disclosure, meaning no patch is confirmed available.
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Leantime is an open source project management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
Leantime is a lean open source project management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.