CVE-2026-59712
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Users::getUser method in Leantime's JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
Risk Assessment
The organization is at risk of account takeover through offline password cracking, bypassing two-factor authentication (2FA), and session hijacking, potentially leading to unauthorized access to sensitive data and systems.
Recommendation
Immediately update Leantime to a version that fixes the authorization issue in the Users::getUser method. Until the update is applied, restrict access to the JSON-RPC API to trusted users only.
Original NVD description (English source)
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.