A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.
Leantime versions before 3.9.6 have an authorization bypass vulnerability in the HTMX plugin install endpoint. This flaw allows authenticated users with limited roles to install marketplace plugins without proper permission validation. Attackers can manipulate plugin properties such as identifier, version, and license key to deploy malicious plugins.
Leantime version 3.6.2 contains a server-side request forgery (SSRF) and local file inclusion (LFI) vulnerability. Authenticated attackers can exploit this issue by passing unsanitized filenames to the Blueprints::import() method via the JSON-RPC API endpoint. This allows them to read internal resources, including arbitrary files on the server or cloud metadata services, by using crafted filenames with URL wrappers or path traversal sequences.
Leantime version 3.6.2 has a cross-site request forgery (CSRF) vulnerability due to the exclusion of the Laravel VerifyCsrfToken middleware from the global middleware stack. This flaw allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by tricking them into submitting malicious requests. Such actions include creating or deleting projects, modifying settings, and changing permissions. There is no information about a patch or fix currently available.
Leantime version 3.6.2 contains an open redirect vulnerability in its Login controller. This flaw allows unauthenticated attackers to manipulate the redirectUrl POST parameter to redirect authenticated users to arbitrary external websites. The vulnerability bypasses FILTER_SANITIZE_URL validation, enabling attackers to craft malicious login URLs that redirect victims to attacker-controlled sites, potentially facilitating phishing or credential theft.
CVE-2026-59712 is a vulnerability in Leantime's JSON-RPC API where the Users::getUser method lacks proper authorization checks. Authenticated users can exploit this flaw to retrieve full user credential data, including password hashes, TOTP secrets, and session tokens, by querying arbitrary user IDs. This enables attackers to enumerate all user accounts and potentially perform offline password cracking, two-factor authentication bypass, and session hijacking.
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.