CVE-2026-66412

Leantime vulnerability CVE-2026-66412 affects all versions prior to 3.6.2. A broken access control flaw in the tickets.getMilestone JSON-RPC endpoint allows authenticated users to read milestone data from projects they aren’t assigned to by supplying arbitrary integer milestone IDs. Attackers can...