Leantime 3.6.2 is vulnerable to CSRF attacks because the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack in app/Http/Kernel.php. This omission enables attackers to craft malicious web pages that, when visited by authenticated users, can trigger unauthorized POST, PUT, and DELETE requests. These requests can alter application state by creating or deleting projects, changing settings, or modifying permissions without the users' consent or knowledge. The vulnerability is identified as CWE-352 and has a high severity rating. No patch or official remediation has been documented in the provided data.

An attacker can exploit this vulnerability to perform unauthorized state-changing operations on behalf of authenticated users without their consent. This can lead to unauthorized project creation or deletion, alteration of application settings, and changes to user permissions, potentially compromising the integrity and security of the affected Leantime instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional CSRF protections manually or restrict access to trusted users only. Monitoring for suspicious activity related to state-changing requests is advisable. Avoid interacting with untrusted links or websites that could trigger CSRF attacks.