Leantime’s JSON‑RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php allows authenticated users to invoke methods that lack a RequiresPermission attribute. An attacker can call api.createApiKeyWithProjects with a chosen role to create an interactive administrator account, elevating privileges from a low‑privilege account to full admin rights. The same missing authorization check also exposes plugin management calls (installPlugin, enablePlugin, disablePlugin, removePlugin) to ordinary users, permitting unauthorized installation or alteration of plugins, which can further compromise system integrity.

All installations of Leantime earlier than version 3.10.0 are affected. No specific patch versions beyond 3.10.0 are listed, so all releases before 3.10.0 are considered vulnerable.

The CVSS score of 8.8 indicates high severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV. Attackers must first be authenticated to the application, then send an XMLHttpRequest header to the JSON‑RPC endpoint and invoke the insecure method. Once authenticated, a simple HTTP request can create an admin account or manipulate plugins, granting full administrative control over the instance. Because the flaw is remote, server‑side, and requires only normal user authentication, the risk is high when Leantime is exposed to the network.