Leantime versions prior to 3.6.2 contain a broken access control flaw that permits authenticated users to retrieve milestone data from projects they are not assigned to by specifying arbitrary integer milestone IDs to the tickets.getMilestone JSON‑RPC endpoint. The flaw enables an attacker to read project planning information—milestone titles, descriptions, and timelines—across all projects within the instance, thereby exposing sensitive business data. This vulnerability is classified as CWE‑639, reflecting an omission of authorization checks on a value supplied by a user.

Leantime, all releases before 3.6.2, as identified by the vendor's CNA listing. No specific sub‑version ranges are provided beyond the upper bound of 3.6.2, so any earlier version is considered affected.

The CVSS score of 7.1 indicates high severity. EPSS score of 0.00238 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been reported. The likely attack vector requires that the attacker authenticate to the application and then utilize the exposed JSON‑RPC endpoint; the vulnerability is exploitable remotely via the standard web interface of a Leantime instance. Given the public availability of the ORM and the fact that users can enumerate integer IDs, the risk of data disclosure is significant for any organization running a vulnerable Leantime installation.