Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the saveSetting function of the API component. An attacker can gain unauthorized access to sensitive information or modify application settings by sending crafted API requests with insufficient authorization...

CVE-2026-15510 Leantime API saveSetting improper authorization

A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early...