Leantime’s JSON‑RPC method users.getUser performs no authorization checks, allowing any authenticated user to request the full credential record for any user ID. The response includes password hashes, TOTP secrets, and active session tokens, providing the data needed for offline password cracking, 2FA bypass, and session hijacking. This flaw is a classic Access Control Failure (CWE‑639).

The vulnerability exists in installations of Leantime. No explicit product version range is listed; the code in the commit 4f2612d13e0e8a2093092a846b445 is affected, so any installation running that or older code is potentially impacted.

The CVSS score of 8.6 indicates high severity. The EPSS score of <1% suggests that exploitation is unlikely in the general population. The vulnerability is not currently listed in the CISA KEV catalog. Inferred from the description, an attacker who has authenticated to the Leantime JSON‑RPC endpoint can invoke the flaw from any network location that can reach the endpoint to obtain credential material for enumerated users.