Is CVE-2026-59712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59712 being exploited in the wild.

How severe is CVE-2026-59712?

High severity, with a CVSS score of 8.1, published 6 July 2026.

Is there a fix for CVE-2026-59712?

A patch was published on 2026-07-04: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59712 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59712?

Check whether you run Leantime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59712: Leantime credential disclosure in JSON-RPC getUser API

CVE-2026-59712 · Severity: high · CVSS 8.1 · Published 2026-07-06

Leantime, a project management system, contains a security flaw in its internal communication interface. An authorized user of the system can bypass security restrictions to view sensitive information about other users, including their encrypted passwords and two-factor authentication (2FA) codes. This could allow a malicious user to take over other accounts, including those of administrators, potentially leading to a full system compromise and data theft.

Technologies: Leantime. Vendors: Leantime.

Quick answers

Is CVE-2026-59712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59712 being exploited in the wild.
How severe is CVE-2026-59712?: High severity, with a CVSS score of 8.1, published 6 July 2026.
Which products and versions are affected?: Leantime <= 3.4.4.
Is there a fix for CVE-2026-59712?: A patch was published on 2026-07-04: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59712 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59712?: Check whether you run Leantime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object Level Authorization (BOLA) vulnerability exists in Leantime's JSON-RPC API due to missing authorization checks in the Users::getUser method. The method is tagged as an API endpoint but lacks the #[RequiresPermission] attribute, causing the PermissionEnforcer to skip authorization. An authenticated attacker can supply arbitrary user IDs to the users.getUser method to retrieve the complete database row for any user. The returned data includes sensitive fields such as bcrypt password hashes, plaintext TOTP secrets, session tokens, and password reset tokens. This enables offline password cracking, 2FA bypass, and session hijacking. The issue is fixed in commit 4f2612d by stripping sensitive fields from the API response.

Affected products

Leantime Leantime <= 3.4.4

Timeline

2026-06-13: disclosed: Initial report to vendor via email
2026-06-20: other: Public issue opened on GitHub repository
2026-07-04: patched: Fix committed to master branch
2026-07-06: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.