Executive brief
Leantime is an open-source project management platform. A security flaw in its internal communication system allows any logged-in user, even those with restricted "read-only" access, to modify global application settings. This could allow an attacker to disrupt operations by changing company branding, tampering with email integration settings, or disabling security and telemetry features across the entire organization.
Technical details
A broken access control vulnerability exists in the Leantime JSON-RPC API. The 'Setting::saveSetting' function fails to perform adequate authorization checks to ensure the caller has administrative privileges. An authenticated attacker with any valid account (including read-only, commenter, or editor roles) can send a crafted POST request to the '/api/jsonrpc' endpoint to overwrite global application settings in the 'zp_settings' table. This can be used to tamper with instance-wide configurations such as SMTP settings, integration keys, and feature toggles. The exploit has been publicly disclosed, and as of the advisory date, the vendor has not responded to the report.
Affected products
- Leantime Leantime up to 3.8.0
Timeline
- 2026-06-02: disclosed: Reported to vendor and submitted to VulDB
- 2026-07-12: advisory: NVD/VulDB publication date