CVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Published Oct 13, 2026 · updated Oct 15, 2026 · Leantime leantime
### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-method authorization on JSON-RPC-exposed service methods) also leaves the service's , , , and methods callable by any authenticated user with no role check, even though their web-UI equivalents correctly require an admin/owner role. ### Details Leantime's JSON-RPC API ( ) reflects any public method on any -annotated service class and dispatches it at . Per-method authorization is enforced by ( ), which reads a PHP attribute off the target method - but when that attribute is **absent**, silently returns and allows the call through. ( ) is -exposed and carries no attribute. It forwards - including a caller-supplied - directly into → , with no server-side clamping of against the calling user's own privilege level: The equivalent web route ( controller) correctly gates account creation behind an admin-only role check ( ), but that gate is bypassed entirely by calling the service directly through JSON-RPC. Separately, , , , and ( , lines ~266/299/320/342) share the same gap: all four are -exposed with no , while their web-controller equivalents ( , ) correctly require / . Authenticating to the JSON-RPC endpoint with an ordinary browser session cookie (rather than a dedicated API key) is sufficient, provided the request carries an header ( ) - this is exactly what the application's own first-party JS client already sends, so no special tooling beyond a normal authenticated session is needed. ### PoC A runnable Python PoC ( library only) reproduces this end-to-end; see the attached . Steps: 1. Create/authenticate as a -role account (the lowest privilege level). Confirm it is correctly
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth
Oct 15, 2026 · GitHub Advisory Database
Fix available
leantime/leantime fixed in 3.10.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
leantime/leantime fixed in 3.10.0
Oct 15, 2026 · GitHub Advisory Database
Updated
### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth
Affected
- Packagist leantime/leantime0 → 3.10.0
- composer leantimeversion unspecified
- vendor Leantime leantimeversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-85990
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnfor
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-54mm-6729-r5wp
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-85990
Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordina
advisories.gitlab.com - OSV.devPackage advisoryGHSA-54mm-6729-r5wp
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
osv.dev