CVE-2026-54418 Details
Description
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).
A vulnerability in Leantime versions through 3.6.2 allows authenticated users to misuse JSON-RPC methods related to two-factor authentication (2FA) without proper authorization checks. The affected methods, 'leantime.rpc.TwoFA.TwoFA.getSetupData' and 'disable2FA', can be invoked with any userId, enabling the caller to access another user's TOTP secret or disable 2FA entirely, thereby undermining account security. This issue arises from the absence of ownership verification, session pinning, and permission attributes, creating a significant authorization flaw in the application's 2FA management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Leantime/leantime | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Leantime | <= 3.6.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |