# CVE-2026-85990: Leantime privilege escalation via unauthorized JSON-RPC methods

Source: https://junglewise.ai/threats/cve-2026-85990-leantime-any-authenticated-user-can-self-escalate-to-admin-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-85990 · Severity: high · CVSS 8.8 · Published 2026-10-13

Leantime is a project management and team collaboration platform. An attacker with any authenticated account—even a read-only user—can escalate their privileges to full administrator by calling unprotected JSON-RPC API methods, gaining complete control of the system. This requires only a valid login and no special credentials or exploit tools.

Technologies: [Leantime](https://junglewise.ai/threats/technologies/leantime), [leantime/leantime (Packagist)](https://junglewise.ai/threats/technologies/leantime-leantime). Vendors: [Leantime](https://junglewise.ai/threats/vendors/leantime), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-85990 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85990 being exploited in the wild.

**How severe is CVE-2026-85990?** High severity, with a CVSS score of 8.8, published 13 October 2026.

**Which products and versions are affected?** Leantime before 3.9.0; leantime/leantime (Packagist) < 3.10.0, ECOSYSTEM:introduced=0,fixed=3.10.0.

**Is there a fix for CVE-2026-85990?** Yes. leantime/leantime (Packagist): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85990 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85990?** Check whether you run Leantime or leantime/leantime (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- leantime/leantime (Packagist): upgrade to 3.10.0 or later

  ```sh
  composer require leantime/leantime:^3.10.0
  ```


## Technical details

The vulnerability stems from missing per-method authorization checks in Leantime's JSON-RPC API dispatcher. The createApiKeyWithProjects() method in the Api service lacks a #[RequiresPermission] attribute and forwards caller-supplied role values directly to account creation without server-side validation, allowing any authenticated user to create admin accounts. Similarly, the Plugins service's installPlugin, enablePlugin, disablePlugin, and removePlugin methods are exposed via JSON-RPC without authorization checks, bypassing the admin-only gates present in the web UI equivalents. Attack requires only an authenticated session cookie with an X-Requested-With header.

## Affected products

- Leantime Leantime before 3.9.0

## Identifiers

- CVE-2026-85990
- GHSA-54mm-6729-r5wp

## Timeline

- 2026-10-15: disclosed: GHSA-54mm-6729-r5wp published
- 2026: patched: Fixed in Leantime 3.9.0 with native permission engine enforcing #[RequiresPermission] attributes

## Related threats

- [Leantime authorization bypass in plugin marketplace endpoint](https://junglewise.ai/threats/cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint)
- [Leantime CSRF protection disabled in global middleware stack](https://junglewise.ai/threats/cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack)
- [Leantime SSRF and LFI in Blueprints import method](https://junglewise.ai/threats/cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method)
- [Leantime open redirect in Login controller](https://junglewise.ai/threats/cve-2026-66414-leantime-open-redirect-in-login-controller)
- [Leantime broken access control in tickets.getMilestone endpoint](https://junglewise.ai/threats/cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint)