Leantime’s JSON‑RPC API prior to version 3.9.0 contains a missing authorization check in the dispatcher. The dispatcher calls service methods without verifying that the caller is authorized, allowing an authenticated user to supply arbitrary user identifiers. For example, the editOwn method accepts a user‑supplied ID without confirming that it belongs to the caller, enabling an attacker to modify another user’s account and set a new password, effectively taking over that account.

All installations of the Leantime JSON‑RPC API running version 3.9.0 or earlier are affected. The issue originates in app/Domain/Api/Controllers/Jsonrpc.php and applies to any instance that exposes the vulnerable dispatcher.

The vulnerability requires an authenticated session; therefore, an attacker must first obtain valid credentials or compromise an existing user account. Once authenticated, the attacker can invoke the vulnerable methods and change other users’ passwords. The CVSS score of 8.8 indicates a high severity. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog; however, the potential for account takeover makes it a high‑impact flaw that should be addressed promptly.