This vulnerability exists in the getAllGrouped function of the file app/Domain/Tickets/Services/Tickets.php within the Kanban Board component of Hyve5 Leantime. The flaw allows remote attackers to perform cross-site scripting (XSS) attacks by manipulating inputs processed by this function. The vulnerability affects versions 3.9.0 through 3.9.8. An exploit has been published, but there are no known exploits in the wild at this time. A patch identified by commit a30a6837b4071ac05a4f58d0e1baa2c62aa8695e is recommended to fix the issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The attack can be carried out remotely without requiring elevated privileges. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the moderate impact and ease of exploitation with user interaction required.

A patch is available and should be deployed to affected versions 3.9.0 through 3.9.8 of Hyve5 Leantime. Applying the patch identified by commit a30a6837b4071ac05a4f58d0e1baa2c62aa8695e will remediate the vulnerability. No additional vendor advisory information is provided, so users should consult official Hyve5 channels for the patch and further guidance.