The vulnerability in Leantime's Users::getUser method within the JSON-RPC API arises from the absence of proper authorization checks. Authenticated users can invoke users.getUser with arbitrary user IDs to access sensitive credential information such as password hashes, TOTP secrets, and session tokens of other users. This exposure enables attackers to enumerate user accounts and leverage the stolen credentials for offline password cracking, two-factor authentication bypass, and session hijacking. The issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No patch or remediation details are currently provided, and no known exploits are reported in the wild.

Authenticated users can access sensitive credential information of any user, including password hashes, TOTP secrets, and session tokens. This compromises user account confidentiality and integrity, enabling offline password cracking, bypassing two-factor authentication, and session hijacking. The vulnerability poses a high risk to user security and system trustworthiness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the JSON-RPC API to trusted users only and monitor for suspicious activity related to user enumeration. Avoid exposing the users.getUser method to untrusted or low-privilege users.