ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-85990

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Published Oct 13, 2026 · catalog updated Oct 15, 2026 · Leantime

Check if you run it

No confirmed exploitation is on record for CVE-2026-85990. EPSS is 0.33%. Act only if a listed version of Leantime is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Version ranges on file
Affected products
Packagist leantime/leantime · composer leantime · composer leantime/leantime · vendor Leantime leantime

### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-method authorization on JSON-RPC-exposed service methods) also leaves the service's , , , and methods callable by any authenticated user with no role check, even though their web-UI equivalents correctly require an admin/owner role. ### Details Leantime's JSON-RPC API ( ) reflects any public method on any -annotated service class and dispatches it at . Per-method authorization is enforced by ( ), which reads a PHP attribute off the target method - but when that attribute is **absent**, silently returns and allows the call through. ( ) is -exposed and carries no attribute. It forwards - including a caller-supplied - directly into → , with no server-side clamping of against the calling user's own privilege level: The equivalent web route ( controller) correctly gates account creation behind an admin-only role check ( ), but that gate is bypassed entirely by calling the service directly through JSON-RPC. Separately, , , , and ( , lines ~266/299/320/342) share the same gap: all four are -exposed with no , while their web-controller equivalents ( , ) correctly require / . Authenticating to the JSON-RPC endpoint with an ordinary browser session cookie (rather than a dedicated API key) is sufficient, provided the request carries an header ( ) - this is exactly what the application's own first-party JS client already sends, so no special tooling beyond a normal authenticated session is needed. ### PoC A runnable Python PoC ( library only) reproduces this end-to-end; see the attached . Steps: 1. Create/authenticate as a -role account (the lowest privilege level). Confirm it is correctly

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Packagist leantime/leantime0 → 3.10.0
  • composer leantimeversion unspecified
  • composer leantime/leantime< 3.10.0
  • vendor Leantime leantimeversion unspecified

How to fix CVE-2026-85990

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-85990. EPSS is 0.33%. Act only if a listed version of Leantime is installed.

Which versions are affected?

Compare what you have installed with 0 → 3.10.0, < 3.10.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-269: Improper Privilege Management; CWE-862: Missing Authorization. EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    leantime/leantime fixed in 3.10.0

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    leantime/leantime fixed in 3.10.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth

Sources

  • CVE.orgVulnerability recordCVE-2026-85990

    Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnfor

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-85990

    30-day exploitation probability 0.3%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-54mm-6729-r5wp

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-85990

    Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordina

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-54mm-6729-r5wp

    Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.