# CVE-2026-66416: Leantime CSRF protection disabled in global middleware stack

Source: https://junglewise.ai/threats/cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-66416 · Severity: high · CVSS 8.8 · Published 2026-07-30

Leantime is a project management system designed for small teams and individuals. A security flaw in the software allows attackers to trick logged-in users into performing unintended actions, such as deleting projects, changing account settings, or modifying permissions. This could lead to significant data loss or unauthorized access if a user visits a malicious website or clicks a link in a phishing email while logged into the application.

Technologies: [Leantime](https://junglewise.ai/threats/technologies/leantime). Vendors: [Leantime](https://junglewise.ai/threats/vendors/leantime).

## Quick answers

**Is CVE-2026-66416 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66416 being exploited in the wild.

**How severe is CVE-2026-66416?** High severity, with a CVSS score of 8.8, published 30 July 2026.

**Which products and versions are affected?** Leantime <= 3.6.2.

**Is there a fix for CVE-2026-66416?** A patch was published on 2026-07-17: Fix PR submitted to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66416 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-66416?** Check whether you run Leantime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Leantime versions up to and including 3.6.2 due to the global omission of the Laravel 'VerifyCsrfToken' middleware in 'app/Http/Kernel.php'. Because this protection is disabled globally, every state-changing endpoint (POST, PUT, DELETE) is vulnerable. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a specially crafted webpage or link. Successful exploitation allows the attacker to execute arbitrary actions with the victim's privileges, including project deletion, permission modification, and setting changes. A fix has been proposed in the project's repository to re-enable the middleware globally while exempting specific non-browser endpoints.

## Affected products

- Leantime Leantime <= 3.6.2

## Timeline

- 2026-07-03: other: Reported to vendor security email
- 2026-07-17: patched: Fix PR submitted to GitHub repository
- 2026-07-20: disclosed: Researcher published security advisory
- 2026-07-30: advisory: NVD and VulnCheck published advisory details

## References

- [https://github.com/Leantime/leantime](https://github.com/Leantime/leantime)
- [https://github.com/Leantime/leantime/pull/3659](https://github.com/Leantime/leantime/pull/3659)
- [https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr](https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr)
- [https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware](https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware)

## Related threats

- [Leantime privilege escalation via unauthorized JSON-RPC methods](https://junglewise.ai/threats/cve-2026-85990-leantime-any-authenticated-user-can-self-escalate-to-admin-via)
- [Leantime authorization bypass in plugin marketplace endpoint](https://junglewise.ai/threats/cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint)
- [Leantime SSRF and LFI in Blueprints import method](https://junglewise.ai/threats/cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method)
- [Leantime open redirect in Login controller](https://junglewise.ai/threats/cve-2026-66414-leantime-open-redirect-in-login-controller)
- [Leantime broken access control in tickets.getMilestone endpoint](https://junglewise.ai/threats/cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint)