CVE-2026-85990 Details
Description
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.
A vulnerability in Leantime's JSON-RPC API allows low-privilege authenticated users to escalate their privileges to admin. This issue is present in versions through 3.9.5. The vulnerability arises because the API method 'leantime.rpc.api.api.createApiKeyWithProjects' lacks proper authorization, allowing users to create admin accounts. Additionally, several plugin management methods are exposed to all authenticated users, enabling unauthorized control over plugins.
Users can update to Leantime version 3.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02 | [email protected] | Source CodeVendor |
| https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e | [email protected] | Source CodeVendor |
| https://github.com/Leantime/leantime/pull/3583 | [email protected] | Issue TrackingVendor |
| https://github.com/Leantime/leantime/pull/3797 | [email protected] | Issue TrackingVendor |
| https://github.com/Leantime/leantime/releases/tag/v3.10.0 | [email protected] | Release NotesVendor |
| https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Leantime | <= 3.9.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |