Leantime vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20232
3. 202610

Newest CVEs

• CVE-2026-85990

  Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

  Leantime · leantime

  High8.8
• CVE-2026-92772

  Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

  Leantime · leantime

  High7.1
• CVE-2026-76647

  Leantime JSON-RPC API contains a missing authorization vulnerability

  Leantime · JSON-RPC API

  High8.8
• CVE-2026-54418

  Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

  Leantime · Leantime

  High8.1
• CVE-2026-66416

  Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware

  Leantime · Leantime

  High8.6
• CVE-2026-66415

  Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

  Leantime · Leantime

  High8.4
• CVE-2026-66414

  Leantime Open Redirect in Login Controller via redirectUrl Parameter

  Leantime · Leantime

  Medium5.1
• CVE-2026-66412

  Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

  Leantime · Leantime

  High7.1
• CVE-2026-59712

  Leantime - JSON-RPC API Broken Access Control via users.getUser

  Leantime · Leantime

  High8.6
• CVE-2026-59713

  Leantime - OIDC Login CSRF via Unconditional State Verification Stub

  Leantime · Leantime

  High8.6