CVE-2026-66416: fallo de gravedad alta en Leantime
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.3%
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Leantime · LeantimeCVEs relacionadas — Leantime
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-5292HIGHTime-based blind injection in LeantimeEPSS 1.4%CVE-2026-59712HIGHLeantime - JSON-RPC API Broken Access Control via users.getUserEPSS 0.4%CVE-2026-66412HIGHLeantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPCEPSS 0.4%CVE-2026-54418HIGHLeantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and BypassEPSS 0.4%CVE-2026-66415HIGHLeantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()EPSS 0.4%CVE-2026-66414MEDIUMLeantime Open Redirect in Login Controller via redirectUrl ParameterEPSS 0.3%
Referencias
https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rrhttps://github.com/Leantime/leantimehttps://github.com/Leantime/leantime/pull/3659https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware