Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 Description The following vulnerabilities were identified in version 3.0.6 of the Leantime goals focused project management system. CVE-2024-27474 A cross-site request forgery CSRF vulnerability which, when triggered, would create and...

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

EUVD-2026-98850

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...

CVE-2026-85990

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-85990

The open-source project management system Leantime is vulnerable to privilege escalation and unauthorized plugin management in versions prior to 3.10.0 . The root cause is located in the JSON-RPC dispatcher (app/Domain/Api/Controllers/Jsonrpc.php), where PermissionEnforcer::enforce allows executi...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

PT-2026-111678

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.10.0 Description The JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods because PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. An...

CVE-2026-85990: Improper Privilege Management

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-94211

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-94210

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...

CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

EUVD-2026-83899

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-94211

Hyve5 Leantime versions up to 3.9.8 are affected by a stored cross-site scripting (XSS) vulnerability in the Project Dashboard component, specifically the file /app/Domain/Dashboard/Templates/show.blade.php. An attacker with EDIT permission can plant a malicious payload in a label name , which is...

CVE-2026-94210

Hyve5 Leantime (up to version 3.9.8 ) contains a cross-site scripting (XSS) vulnerability in the Kanban Board component, specifically in the getAllGrouped function of app/Domain/Tickets/Services/Tickets.php. The attack is remotely exploitable and requires low privileges and user interaction . CVS...

CVE-2026-94210 Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...

EUVD-2026-83890

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...