Is CVE-2026-85990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85990 being exploited in the wild.

How severe is CVE-2026-85990?

High severity, with a CVSS score of 8.8, published 13 October 2026.

Which products and versions are affected?

Leantime before 3.9.0; leantime/leantime (Packagist) < 3.10.0, ECOSYSTEM:introduced=0,fixed=3.10.0.

Is there a fix for CVE-2026-85990?

Yes. leantime/leantime (Packagist): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85990 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85990?

Check whether you run Leantime or leantime/leantime (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85990: Leantime privilege escalation via unauthorized JSON-RPC methods

Q: Is there a fix for CVE-2026-85990?

Yes. leantime/leantime (Packagist): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-85990 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-85990?

Check whether you run Leantime or leantime/leantime (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85990 · Severity: high · CVSS 8.8 · Published 2026-10-13

Leantime is a project management and team collaboration platform. An attacker with any authenticated account—even a read-only user—can escalate their privileges to full administrator by calling unprotected JSON-RPC API methods, gaining complete control of the system. This requires only a valid login and no special credentials or exploit tools.

Technologies: Leantime, leantime/leantime (Packagist). Vendors: Leantime, Packagist.

Quick answers

Is CVE-2026-85990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85990 being exploited in the wild.
How severe is CVE-2026-85990?: High severity, with a CVSS score of 8.8, published 13 October 2026.
Which products and versions are affected?: Leantime before 3.9.0; leantime/leantime (Packagist) < 3.10.0, ECOSYSTEM:introduced=0,fixed=3.10.0.
Is there a fix for CVE-2026-85990?: Yes. leantime/leantime (Packagist): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85990 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85990?: Check whether you run Leantime or leantime/leantime (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

leantime/leantime (Packagist): upgrade to 3.10.0 or later
```
composer require leantime/leantime:^3.10.0
```

Technical details

The vulnerability stems from missing per-method authorization checks in Leantime's JSON-RPC API dispatcher. The createApiKeyWithProjects() method in the Api service lacks a #[RequiresPermission] attribute and forwards caller-supplied role values directly to account creation without server-side validation, allowing any authenticated user to create admin accounts. Similarly, the Plugins service's installPlugin, enablePlugin, disablePlugin, and removePlugin methods are exposed via JSON-RPC without authorization checks, bypassing the admin-only gates present in the web UI equivalents. Attack requires only an authenticated session cookie with an X-Requested-With header.

Affected products

Leantime Leantime before 3.9.0

Identifiers

CVE-2026-85990
GHSA-54mm-6729-r5wp

Timeline

2026-10-15: disclosed: GHSA-54mm-6729-r5wp published
2026: patched: Fixed in Leantime 3.9.0 with native permission engine enforcing #[RequiresPermission] attributes

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.