A flaw in the getAllGrouped function of the Tickets.php service allows an attacker to inject and store malicious script payloads that are later rendered while users view the Kanban board. This stored XSS can execute arbitrary JavaScript, potentially hijacking user sessions, exfiltrating sensitive data, or launching further attacks within the victim’s browser.

The vulnerability affects all Hyve5 Leantime releases up to and including version 3.9.8. The exposed endpoint is the Kanban board’s Tickets.php service, specifically the getAllGrouped method. A fixed commit (a30a6837b4071ac05a4f58d0e1baa2c62aa8695e) is available and should be applied to eliminate the vulnerable code path.

The CVSS score of 5.1 indicates moderate severity, and no EPSS data is available, suggesting limited insight into current exploitation trends. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by crafting input that is processed by getAllGrouped; public exploits have been published illustrating the ability to execute arbitrary JavaScript in victim browsers.