CVE-2026-59712highCWE-639

CVE-2026-59712: high-severity vulnerability in Leantime

Leantime - JSON-RPC API Broken Access Control via users.getUser

Published · Updated

Follow this CVE+ Monitor Leantime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.4%
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Leantime · Leantime
Related CVEs — Leantime

In the same product, most dangerous first.

CVE-2020-5292HIGHTime-based blind injection in LeantimeEPSS 1.4%CVE-2026-66412HIGHLeantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPCEPSS 0.4%CVE-2026-54418HIGHLeantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and BypassEPSS 0.4%CVE-2026-66415HIGHLeantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()EPSS 0.4%CVE-2026-66414MEDIUMLeantime Open Redirect in Login Controller via redirectUrl ParameterEPSS 0.3%CVE-2026-66416HIGHLeantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken MiddlewareEPSS 0.3%