Executive brief
Leantime, a project management system, contains a security flaw that allows any logged-in user to view project milestones they are not authorized to see. By guessing milestone identification numbers, an attacker can access sensitive project planning information, including titles, descriptions, and timelines across the entire organization. This could lead to the exposure of strategic roadmaps and internal project details to unauthorized employees or compromised accounts.
Technical details
A broken access control vulnerability (Insecure Direct Object Reference) exists in the `tickets.getMilestone` JSON-RPC endpoint of Leantime. The `getMilestone()` method in `app/Domain/Tickets/Services/Tickets.php` lacked a project ownership check, only verifying general ticket-read permissions. An authenticated attacker can supply arbitrary integer milestone IDs to the API to retrieve sensitive data, including milestone titles, descriptions, and timelines, regardless of their project membership. The issue is resolved by adding a project assignment verification check using `isUserAssignedToProject()` before returning data.
Affected products
- Leantime Leantime <= 3.6.2
Timeline
- 2026-07-17: disclosed: Initial pull request and fix submitted by researcher
- 2026-07-19: patched: Fix merged into master branch
- 2026-07-27: advisory: NVD and VulnCheck advisories published
References
- https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae
- https://github.com/Leantime/leantime/pull/3657
- https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
- https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc