Read the docs

Leantime

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9

Exploited now

Leantime records in CISA KEV

No Leantime vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Leantime 9 records HIGH

Records

19 records

TI-2026-53555 CVE-2026-76647 · GHSA-62fx-wqcf-qg97

Leantime JSON-RPC API contains a missing authorization vulnerability

Priority HIGH 73

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00506 Published 2026-08-19 No fix listed CWE-200
TI-2026-62514 CVE-2026-92772 · GHSA-7j6f-xmpq-5jjm

Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Priority MEDIUM 64

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00528 Published 2026-09-16 Fixed in 3.9.6 CWE-862
TI-2026-47171 CVE-2026-66412 · GHSA-p3jw-q4jg-x8w9

Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Priority MEDIUM 64

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the ti…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-07-27 No fix listed CWE-639
TI-2026-47172 CVE-2026-66414 · GHSA-pjx9-wh57-j26p

Leantime Open Redirect in Login Controller via redirectUrl Parameter

Priority MEDIUM 56

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parame…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00345 Published 2026-07-30 No fix listed CWE-601
TI-2020-04348 CVE-2020-5292

Time-based blind injection in Leantime

Priority MEDIUM 41

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01405 Published 2020-03-31 Fixed in 2.0.15 CWE-89
TI-2026-42585 CVE-2026-59712 · GHSA-hphp-fmhr-5fqh

Leantime - JSON-RPC API Broken Access Control via users.getUser

Priority MEDIUM 40

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00448 Published 2026-07-06 No fix listed CWE-639
TI-2026-47174 CVE-2026-66416 · GHSA-w22w-fm87-f6gx

Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

Priority LOW 39

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middlew…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00256 Published 2026-07-30 No fix listed CWE-352
TI-2026-42586 CVE-2026-59713 · GHSA-vwm8-rprj-29f7

Leantime - OIDC Login CSRF via Unconditional State Verification Stub

Priority LOW 39

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00234 Published 2026-07-06 No fix listed CWE-352
TI-2026-39294 CVE-2026-54418 · GHSA-j9c4-c6g5-c9fv

Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Priority LOW 37

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pin…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-05 No fix listed CWE-862
TI-2026-47173 CVE-2026-66415 · GHSA-rfxf-9pcf-q3rq

Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Priority LOW 36

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_conte…

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.0035 Published 2026-07-30 No fix listed CWE-918
TI-2023-24586 CVE-2023-45826

Authenticated SQL Injection in leantime

Priority LOW 33

Leantime is an open source project management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02116 Published 2023-10-19 Fixed in 2.4-beta-4 CWE-89
TI-2024-18281 CVE-2024-27477 · GHSA-fw35-8hjm-jw2p

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation…

Priority LOW 28

In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00628 Published 2024-04-10 No fix listed CWE-79
Open these records in search →