Leantime versions up to 3.6.2 expose JSON‑RPC methods that operate on a caller‑supplied userId without any ownership check, session pinning, or permission gate. An authenticated user can call these methods to read another user’s live TOTP secret or to permanently disable that user’s two‑factor authentication. The flaw is an example of missing authorization, classified as CWE‑862, and results in the loss of the intended security boundary provided by 2FA.

The affected vendor is Leantime and the product is the Leantime application. All releases up to and including version 3.6.2 are vulnerable; later releases are believed to contain a fix, but no specific version number is listed in the available data.

The CVSS score of 8.1 indicates a high severity vulnerability. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an established authenticated session; an attacker who is logged in as any user can invoke the vulnerable RPC methods using an arbitrary userId to obtain another user’s secret or to remove 2FA. Because the disclosure is solely dependent on the presence of valid credentials, the attack vector is an authenticated, malicious user interacting with the application’s JSON‑RPC interface.