CVE-2026-94210

LowCVSS 3.5

Published: 21/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

Risk Assessment

An attacker can remotely inject a malicious script that executes in the browsers of users viewing the Kanban board, potentially leading to session data theft or other actions in the victim's context.

Recommendation

Deploy the patch named a30a6837b4071ac05a4f58d0e1baa2c62aa8695e or update Leantime to a version containing this fix.

Other vulnerabilities in Hyve5 Leantime

CVE-2026-94211Low
A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS