CVE-2026-94210
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
CVSS Score
3.5
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.
| CWE | CWE-79 CWE-94 |
| Vendor | hyve5 |
| Product | leantime |
| Published | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for hyve5 leantime
Be the first to know when new low vulnerabilities affecting hyve5 leantime are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Hyve5 / Leantime
3.9.0 3.9.1 3.9.2 3.9.3 3.9.4 3.9.5 3.9.6 3.9.7 3.9.8
References
vuldb.com: https://vuldb.com/vuln/408068 vuldb.com: https://vuldb.com/vuln/408068/cti vuldb.com: https://vuldb.com/cve/CVE-2026-94210 vuldb.com: https://vuldb.com/submit/894646 github.com: https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/Stored%20XSS%20in%20Leantime%20Kanban%20Swimlane%20Headers%20Enables%20Privilege%20Escalation%20to%20Owner github.com: https://github.com/Leantime/leantime/pull/3767 github.com: https://github.com/Leantime/leantime/commit/a30a6837b4071ac05a4f58d0e1baa2c62aa8695e
Credits
🔍 alvinovando-thoropass (VulDB User)