Read the docs
TI-2026-71921 Aliases CVE-2026-85990GHSA-54mm-6729-r5wp

Missing authorization in Leantime lets users create admin accounts

Priority HIGH 73CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-862.

Summary

Leantime versions before 3.10.0 are affected. The JSON-RPC dispatcher exposes API service methods that lack a per-method permission check, which is missing authorization (CWE-862). A remote attacker with a low-privilege authenticated account can call an API method to create an interactive administrator account with a chosen role. The same missing check lets such a user install, enable, disable and remove plugins.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed leantime (Leantime): 3.10.0leantime/leantime (Packagist): 3.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Leantimeleantimebefore 3.10.03.10.0Patch availableCNA
—leantime/leantime (Packagist)before 3.10.03.10.0Patch availableGHSA-54mm-6729-r5wp
  • leantime VendorLeantime Affected before 3.10.0 Fixed in 3.10.0 Patch available CNA
  • leantime/leantime (Packagist) Vendor— Affected before 3.10.0 Fixed in 3.10.0 Patch available GHSA-54mm-6729-r5wp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*——Leantime
  • cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:* Versions — — ·Leantime

Remediation

Upgrade the leantime/leantime Packagist package to version 3.10.0, which fixes the complete issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA leantime (Leantime) Fixed in 3.10.0
  • Fix · GHSA-54mm-6729-r5wp leantime/leantime (Packagist) Fixed in 3.10.0 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-85990
  2. 2026-10-14 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Alias added: GHSA-54mm-6729-r5wp
  4. 2026-10-16 Fix available: Packagist/leantime/[email protected] · GHSA-54mm-6729-r5wp
  5. 2026-10-16 CVSS score added · GHSA-54mm-6729-r5wp
  6. 2026-10-16 Weakness changed · GHSA-54mm-6729-r5wp
  7. 2026-10-16 8 new references · GHSA-54mm-6729-r5wp
  8. 2026-10-18 CISA SSVC decision points changed
  9. 2026-10-18 Priority changed: LOW → HIGH

References

Advisory 1

Other 7

  • TI-2026-53555 Leantime JSON-RPC API contains a missing authorization vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-18279 Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
  • TI-2024-18354 Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute… CVSS 3.1HIGH 7.6
  • TI-2026-62514 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX CVSS 4.0HIGH 7.1
  • TI-2026-47171 Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC CVSS 4.0HIGH 7.1
  • TI-2024-18353 Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute… CVSS 3.1MEDIUM 5.4
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences