CVE-2026-15509 is an improper authorization vulnerability affecting Leantime up to version 3.8.0. The issue resides in the JSON-RPC endpoint's editUser and addUser functions, where manipulation of the role argument can lead to unauthorized privilege escalation or modification. The vulnerability is remotely exploitable without user interaction and requires low privileges to attempt. The vendor has not provided a fix or official response, and the vulnerability details have been publicly disclosed.

Successful exploitation could allow an attacker with limited privileges to escalate their permissions or modify user roles remotely, potentially compromising the integrity of user management within Leantime. This could lead to unauthorized access or administrative control over the affected system. However, no active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restrict access to the JSON-RPC endpoint and limit user privileges to reduce exposure.