CVE-2026-66412

MEDIUM 6.5

Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

CWE	CWE-639
Vendor	leantime
Product	leantime
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for leantime leantime

Be the first to know when new medium vulnerabilities affecting leantime leantime are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Leantime / Leantime

0 ≤ 3.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6 github.com: https://github.com/Leantime/leantime/pull/3657 github.com: https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae vulncheck.com: https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc

Credits

🔍 Javokhir Tursunboyev (@javokhir-sec)