CVE-2026-76647: CWE-862 Missing Authorization in Leantime JSON-RPC API

CVE-2026-76647 describes a missing authorization vulnerability in the Leantime JSON-RPC API through version 3.8.0. The JSON-RPC dispatcher located in app/Domain/Api/Controllers/Jsonrpc.php fails to enforce authorization before calling service-layer methods. As a result, an authenticated user can call methods or act on resources beyond their permissions. For example, the editOwn method accepts a user-supplied user ID without verifying ownership, allowing modification of other users' accounts and password resets. This vulnerability is due to the lack of centralized authorization enforcement in the dispatcher, differentiating it from other Leantime vulnerabilities that stem from individual method behavior.

An attacker with valid authentication can exploit this vulnerability to perform unauthorized actions on other users' accounts, including changing passwords and taking over accounts. This leads to a high impact on confidentiality, integrity, and availability of user accounts within Leantime instances running affected versions.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the JSON-RPC API to trusted users only and monitor for suspicious activity related to account modifications. Implement additional access controls or compensating controls if possible.