CVE-2026-66412
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.5 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Description
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-639
Source
NVD
Vendor
Leantime
Product
Leantime
External References
- https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae
- https://github.com/Leantime/leantime/pull/3657
- https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
- https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc
Discussion (0)
Add Comment
No comments yet. Be the first!