Vulnerabilities in Leantime
13 resultsCVE-2023-45826MEDIUMAuthenticated SQL Injection in leantimeEPSS 2.1%CVE-2020-5292HIGHTime-based blind injection in LeantimeEPSS 1.4%CVE-2026-92772HIGHLeantime before 3.9.6 Unauthorized Plugin Installation via HTMXEPSS 0.5%CVE-2026-76647HIGHLeantime JSON-RPC API contains a missing authorization vulnerabilityEPSS 0.5%CVE-2026-59712HIGHLeantime - JSON-RPC API Broken Access Control via users.getUserEPSS 0.4%CVE-2026-85990HIGHLeantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsEPSS 0.4%CVE-2026-66412HIGHLeantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPCEPSS 0.4%CVE-2023-33961HIGHLeantime Stored Cross-site Scripting VulnerabilityEPSS 0.4%CVE-2026-66415HIGHLeantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()EPSS 0.4%CVE-2026-54418HIGHLeantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and BypassEPSS 0.4%CVE-2026-66414MEDIUMLeantime Open Redirect in Login Controller via redirectUrl ParameterEPSS 0.3%CVE-2026-66416HIGHLeantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken MiddlewareEPSS 0.3%CVE-2026-59713HIGHLeantime - OIDC Login CSRF via Unconditional State Verification StubEPSS 0.2%