CVE-2026-15509

Leantime JSON-RPC Endpoint addUser improper authorization

View on CVE.org
Published Jul 12, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability exposes an improper authorization flaw in the Leantime JSON‑RPC Endpoint’s addUser function that allows a remote attacker to supply a manipulated role argument and thereby elevate their privileges beyond what is intended. By assigning themselves an owner or admin role, an attacker can gain full control of the application, accessing sensitive data, modifying project settings, and potentially disrupting operations.

Affected Systems

All Leantime releases up to and including version 3.8.0 are affected. The flaw exists across all deployments of these versions and there is currently no vendor‑supplied patch or updated release containing a fix.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the JSON‑RPC endpoint, which is typically reachable unless network controls are implemented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a Leantime version newer than 3. official vendor patch if released
  • Restrict the JSON‑RPC endpoint to trusted networks or place it behind firewall rules to limit remote reachability
  • Implement server‑side validation or role‑based access checks to prevent unauthorized assignment of elevated roles

Generated by OpenCVE AI on August 1, 2026 at 11:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Leantime JSON-RPC Endpoint addUser improper authorization
First Time appeared Leantime
Leantime leantime
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*
Vendors & Products Leantime
Leantime leantime
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 3:36 PM
Reserved
Jul 12, 2026, 5:58 AM

View source JSON

Updated
Jul 15, 2026, 3:35 PM

JSON

Status
Deferred
Published
Jul 12, 2026, 11:16 PM
Modified
Jul 15, 2026, 4:16 PM

View source JSON

No data.

Updated
Aug 1, 2026, 11:15 AM

JSON