Executive brief
Leantime, an open-source project management system, contains a security flaw that allows any logged-in user to grant themselves administrative privileges. By sending a specially crafted request to the system's internal programming interface, a low-level user (such as a 'Read-only' user or 'Commenter') can promote their account to 'Owner' status. This gives the attacker full control over all projects, client data, and global settings, and could potentially allow them to take over the entire server.
Technical details
A broken access control vulnerability (CWE-862) exists in the JSON-RPC endpoint of Leantime versions up to 3.8.0. The 'editUser' and 'addUser' methods in the Users service fail to implement authorization checks, relying on the dispatcher which only verifies if a method is tagged with '@api'. An authenticated attacker with low privileges (e.g., Editor, Read-only) can invoke these methods to modify their own 'role' parameter to 'Owner' (role ID 50) or create new administrative accounts. This flaw can be further leveraged to achieve Remote Code Execution (RCE) by installing malicious plugins, a capability reserved for Owner accounts. The vendor has not yet released a patch.
Affected products
- Leantime Leantime up to 3.8.0
Timeline
- 2026-06-02: disclosed: Vulnerability reported to vendor and VulDB by Bytium.
- 2026-07-12: advisory: Public disclosure via NVD and VulDB.