EUVD-2026-98850

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...

GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

CVE-2026-85990

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-85990

The open-source project management system Leantime is vulnerable to privilege escalation and unauthorized plugin management in versions prior to 3.10.0 . The root cause is located in the JSON-RPC dispatcher (app/Domain/Api/Controllers/Jsonrpc.php), where PermissionEnforcer::enforce allows executi...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

PT-2026-111678

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.10.0 Description The JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods because PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. An...

CVE-2026-85990: Improper Privilege Management

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...