The vulnerability resides in the Settingantime's API module. It fails to verify that the client has the correct permissions before saving configuration data. Based on the description, it is inferred that an unauthenticated or insufficiently privileged attacker could alter system settings through that API endpoint. This weakness enables unauthorized changes that may compromise the integrity of the application, potentially allowing further privilege escalation or denial of service.

Leantime application. Versions up to 3.8.0 are affected. The issue is tied to the API that manages settings.

The CVSS base score of 5.3 indicates a medium severity risk. The EPSS score of <1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. However, the exploit is publicly available, and the issue can be triggered from remote HTTP requests. It is inferred that attackers would need to send crafted API calls to the Setting::saveSetting endpoint, likely bypassing existing authorization checks. Organizations should prioritize patching or mitigating the exposure promptly.