CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
| CWE | CWE-352 |
| Vendor | leantime |
| Product | leantime |
| Published | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for leantime leantime
Be the first to know when new high vulnerabilities affecting leantime leantime are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Leantime / Leantime
0 < 3.6.2
References
github.com: https://github.com/Leantime/leantime/pull/3659 github.com: https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr github.com: https://github.com/Leantime/leantime vulncheck.com: https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware
Credits
🔍 Javokhir Tursunboyev (@javokhir-sec)