Description
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
Published: 2026-07-06
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Leantime's JSON-RPC method users.getUser does not perform proper authorization checks, resulting in a CWE-639 (Access Control Failure). When called with any user identifier, the method returns the entire credential record for that user, exposing password hashes, TOTP secrets, and live session tokens. This flaw allows an authenticated actor to enable offline password cracking, two‑factor authentication bypass, and session hijacking.

Affected Systems

The vulnerability exists in Leantime installations. No explicit version range is given, but the flaw is present in the codebase referenced by commit 4f2612d13e0e8a2093092a846b445 earlier releases. Any deployment running the affected code is potentially impacted.

Risk and Exploitability

The CVSS score is 8.6, reflecting high severity. The EPSS score is < 1%, indicating a low probability of exploitation in the general population. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that attackers can invoke the flaw from any network location that can reach the Leantime JSON‑RPC endpoint to retrieve credential material for enumerated users.

Generated by OpenCVE AI on July 26, 2026 at 20:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Leant 4f2612d13e0e8a2093092a846b44506cf133b671 where the users.getUser method has been fixed.
  • Restrict external access to the JSON‑RPC endpoint by configuring the web server or firewall so that only trusted hosts it.
  • Implement or enable application‑level authorization checks that verify a requester's identity before returning any credential data, and consider disabling users.getUser for una removing it from public API exposure.

Generated by OpenCVE AI on July 26, 2026 at 20:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Leantime - Credential Disclosure via Unauthenticated JSON-RPC users.getUser Method Leantime - JSON-RPC API Broken Access Control via users.getUser

Tue, 07 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
Title Leantime - Credential Disclosure via Unauthenticated JSON-RPC users.getUser Method
First Time appeared Leantime
Leantime leantime
Weaknesses CWE-639
CPEs cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*
Vendors & Products Leantime
Leantime leantime
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Leantime Leantime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-20T17:46:02.732Z

Reserved: 2026-07-06T15:31:46.188Z

Link: CVE-2026-59712

cve-icon Vulnrichment

Updated: 2026-07-07T13:43:46.406Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:15:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key