CVE-2026-85990

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.

Leantime through 3.6.2 exposes JSON-RPC methods for TwoFA that act on a caller-supplied userId without ownership check, session pinning, or permission-attribute gate.

Leantime 3.6.2 contains a cross-site request forgery vulnerability due to missing VerifyCsrfToken middleware. Unauthenticated attackers can trick authenticated users into performing unauthorized actions like creating or deleting projects, modifying settings, and changing permissions.

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability in the Blueprints::import() method. Authenticated attackers can supply unsanitized filenames with URL wrappers or path traversal sequences to read internal resources like cloud metadata services or arbitrary files from the server filesystem.

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller, allowing unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter, bypassing FILTER_SANITIZE_URL validation.

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

A vulnerability was found in Leantime up to version 3.8.0 in the Setting::saveSetting function of the API component. Manipulation leads to improper authorization, allowing remote attacks. The exploit has been made public and could be used.

A vulnerability in Leantime up to version 3.8.0 affects the JSON-RPC Endpoint component. The editUser/addUser functions improperly authorize the 'role' argument, allowing unauthorized privilege changes. The attack is remotely exploitable and exploit details are publicly available.

Leantime has an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.