CVE-2026-66416 Details
Description
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
A cross-site request forgery (CSRF) vulnerability has been identified in Leantime version 3.6.2. This vulnerability arises from the exclusion of the Laravel VerifyCsrfToken middleware from the global middleware stack, allowing unauthenticated attackers to perform state-changing actions on behalf of authenticated users. Exploitation can be achieved by crafting malicious pages, delivered through phishing emails or harmful websites, that trigger unauthorized POST, PUT, and DELETE requests. These requests can create or delete projects, modify settings, and change permissions as if they were performed by the authenticated user.
Users can update to Leantime version 3.9.8, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Leantime | <= 3.6.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | CVE Modified | [email protected] |
| Jul 30, 2026 | New CVE Received | [email protected] |