CVE-2026-15509

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.

Leantime through 3.6.2 exposes JSON-RPC methods for TwoFA that act on a caller-supplied userId without ownership check, session pinning, or permission-attribute gate.

Leantime 3.6.2 contains a cross-site request forgery vulnerability due to missing VerifyCsrfToken middleware. Unauthenticated attackers can trick authenticated users into performing unauthorized actions like creating or deleting projects, modifying settings, and changing permissions.

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability in the Blueprints::import() method. Authenticated attackers can supply unsanitized filenames with URL wrappers or path traversal sequences to read internal resources like cloud metadata services or arbitrary files from the server filesystem.

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller, allowing unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter, bypassing FILTER_SANITIZE_URL validation.

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

A vulnerability was found in Leantime up to version 3.8.0 in the Setting::saveSetting function of the API component. Manipulation leads to improper authorization, allowing remote attacks. The exploit has been made public and could be used.

Leantime has an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

The Users::getUser method in Leantime's JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.