CVE-2026-15509 describes an improper authorization vulnerability in Leantime's JSON-RPC endpoint, specifically affecting the editUser and addUser functions. The vulnerability is due to insufficient validation of the role argument, which can be manipulated remotely to escalate privileges or alter user roles without proper authorization. The vulnerability affects Leantime versions 3.0 through 3.8.0 inclusive. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and no known exploits in the wild have been confirmed.

An attacker can remotely manipulate user roles via the JSON-RPC endpoint without proper authorization, potentially leading to unauthorized privilege escalation or unauthorized user management actions. This could compromise the integrity of user accounts and access controls within affected Leantime installations.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the JSON-RPC endpoint to trusted networks or authenticated users only, if possible, and monitor for suspicious activity related to user role changes.