CVE-2026-66416
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Leantime 3.6.2 contains a cross-site request forgery vulnerability due to missing VerifyCsrfToken middleware. Unauthenticated attackers can trick authenticated users into performing unauthorized actions like creating or deleting projects, modifying settings, and changing permissions.
Risk Assessment
Risk of unauthorized system changes by an attacker exploiting a victim to perform malicious operations without their consent.
Recommendation
Update Leantime to a version that restores CSRF protection and implement CSRF prevention mechanisms.
Other vulnerabilities in Leantime
See all- CVE-2026-76647High
Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.
- CVE-2026-54418High
Leantime through 3.6.2 exposes JSON-RPC methods for TwoFA that act on a caller-supplied userId without ownership check, session pinning, or permission-attribute gate.
- CVE-2026-66415High
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability in the Blueprints::import() method. Authenticated attackers can supply unsanitized filenames with URL wrappers or path traversal sequences to read internal resources like cloud metadata services or arbitrary files from the server filesystem.
- CVE-2026-66414Medium
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller, allowing unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter, bypassing FILTER_SANITIZE_URL validation.
- CVE-2026-66412Medium
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
- CVE-2026-15510Medium
A vulnerability was found in Leantime up to version 3.8.0 in the Setting::saveSetting function of the API component. Manipulation leads to improper authorization, allowing remote attacks. The exploit has been made public and could be used.
- CVE-2026-15509Medium
A vulnerability in Leantime up to version 3.8.0 affects the JSON-RPC Endpoint component. The editUser/addUser functions improperly authorize the 'role' argument, allowing unauthorized privilege changes. The attack is remotely exploitable and exploit details are publicly available.
- CVE-2026-59713High
Leantime has an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
- CVE-2026-59712High
The Users::getUser method in Leantime's JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
Original NVD description (English source)
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.