CVE-2026-59712

HIGH 8.1

Leantime - JSON-RPC API Broken Access Control via users.getUser

CVSS Score

8.1

EPSS Score

0.3%

EPSS Percentile

16th

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

CWE	CWE-639
Vendor	leantime
Product	leantime
Published	Jul 6, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for leantime leantime

Be the first to know when new high vulnerabilities affecting leantime leantime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Leantime / Leantime

0 ≤ 3.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Leantime/leantime/issues/3556 github.com: https://github.com/Leantime/leantime github.com: https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671 vulncheck.com: https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method

Credits

🔍 George Chen