{"schema_version":1,"title":"Leantime vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Leantime: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92772, was published on 16 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/leantime","json_url":"https://junglewise.ai/threats/vendors/leantime.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/leantime","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":5,"all_time":9,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":9,"last_365_days":9},"latest":[{"cve":"CVE-2026-92772","cvss":7.1,"epss":0.0053,"slug":"cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint","title":"Leantime authorization bypass in plugin marketplace endpoint","severity":"high","exploited":false,"published_at":"2026-09-16T21:17:25.897+00:00","url":"https://junglewise.ai/threats/cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint"},{"cve":"CVE-2026-66416","cvss":8.8,"slug":"cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack","title":"Leantime CSRF protection disabled in global middleware stack","severity":"high","exploited":false,"published_at":"2026-07-30T19:18:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack"},{"cve":"CVE-2026-66415","cvss":8.5,"slug":"cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method","title":"Leantime SSRF and LFI in Blueprints import method","severity":"high","exploited":false,"published_at":"2026-07-30T19:18:36.19+00:00","url":"https://junglewise.ai/threats/cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method"},{"cve":"CVE-2026-66414","cvss":6.1,"slug":"cve-2026-66414-leantime-open-redirect-in-login-controller","title":"Leantime open redirect in Login controller","severity":"medium","exploited":false,"published_at":"2026-07-30T17:16:34.21+00:00","url":"https://junglewise.ai/threats/cve-2026-66414-leantime-open-redirect-in-login-controller"},{"cve":"CVE-2026-66412","cvss":6.5,"slug":"cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint","title":"Leantime broken access control in tickets.getMilestone endpoint","severity":"medium","exploited":false,"published_at":"2026-07-27T07:16:30.317+00:00","url":"https://junglewise.ai/threats/cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint"},{"cve":"CVE-2026-15510","cvss":6.3,"slug":"cve-2026-15510-leantime-improper-authorization-in-setting-savesetting-api","title":"Leantime improper authorization in Setting::saveSetting API","severity":"medium","exploited":false,"published_at":"2026-07-12T23:16:37.977+00:00","url":"https://junglewise.ai/threats/cve-2026-15510-leantime-improper-authorization-in-setting-savesetting-api"},{"cve":"CVE-2026-15509","cvss":6.3,"slug":"cve-2026-15509-leantime-privilege-escalation-in-json-rpc-edituser-and-adduser","title":"Leantime privilege escalation in JSON-RPC editUser and addUser","severity":"medium","exploited":false,"published_at":"2026-07-12T23:16:37.817+00:00","url":"https://junglewise.ai/threats/cve-2026-15509-leantime-privilege-escalation-in-json-rpc-edituser-and-adduser"},{"cve":"CVE-2026-59713","cvss":8.1,"slug":"cve-2026-59713-leantime-oidc-login-csrf-in-verifystate-method","title":"Leantime OIDC login CSRF in verifyState method","severity":"high","exploited":false,"published_at":"2026-07-06T21:16:58.93+00:00","url":"https://junglewise.ai/threats/cve-2026-59713-leantime-oidc-login-csrf-in-verifystate-method"},{"cve":"CVE-2026-59712","cvss":8.1,"slug":"cve-2026-59712-leantime-credential-disclosure-in-json-rpc-getuser-api","title":"Leantime credential disclosure in JSON-RPC getUser API","severity":"high","exploited":false,"published_at":"2026-07-06T21:16:58.793+00:00","url":"https://junglewise.ai/threats/cve-2026-59712-leantime-credential-disclosure-in-json-rpc-getuser-api"}],"vendor":{"hub":true,"name":"Leantime","slug":"leantime","homepage":"https://leantime.io/","description":"Leantime is the company behind the open-source project management platform of the same name.","url":"https://junglewise.ai/threats/vendors/leantime"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-66416","cvss":8.8,"slug":"cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack","title":"Leantime CSRF protection disabled in global middleware stack","severity":"high","exploited":false,"published_at":"2026-07-30T19:18:36.34+00:00","url":"https://junglewise.ai/threats/cve-2026-66416-leantime-csrf-protection-disabled-in-global-middleware-stack"},{"cve":"CVE-2026-66415","cvss":8.5,"slug":"cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method","title":"Leantime SSRF and LFI in Blueprints import method","severity":"high","exploited":false,"published_at":"2026-07-30T19:18:36.19+00:00","url":"https://junglewise.ai/threats/cve-2026-66415-leantime-ssrf-and-lfi-in-blueprints-import-method"},{"cve":"CVE-2026-59713","cvss":8.1,"slug":"cve-2026-59713-leantime-oidc-login-csrf-in-verifystate-method","title":"Leantime OIDC login CSRF in verifyState method","severity":"high","exploited":false,"published_at":"2026-07-06T21:16:58.93+00:00","url":"https://junglewise.ai/threats/cve-2026-59713-leantime-oidc-login-csrf-in-verifystate-method"},{"cve":"CVE-2026-59712","cvss":8.1,"slug":"cve-2026-59712-leantime-credential-disclosure-in-json-rpc-getuser-api","title":"Leantime credential disclosure in JSON-RPC getUser API","severity":"high","exploited":false,"published_at":"2026-07-06T21:16:58.793+00:00","url":"https://junglewise.ai/threats/cve-2026-59712-leantime-credential-disclosure-in-json-rpc-getuser-api"},{"cve":"CVE-2026-92772","cvss":7.1,"epss":0.0053,"slug":"cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint","title":"Leantime authorization bypass in plugin marketplace endpoint","severity":"high","exploited":false,"published_at":"2026-09-16T21:17:25.897+00:00","url":"https://junglewise.ai/threats/cve-2026-92772-leantime-authorization-bypass-in-plugin-marketplace-endpoint"},{"cve":"CVE-2026-66412","cvss":6.5,"slug":"cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint","title":"Leantime broken access control in tickets.getMilestone endpoint","severity":"medium","exploited":false,"published_at":"2026-07-27T07:16:30.317+00:00","url":"https://junglewise.ai/threats/cve-2026-66412-leantime-broken-access-control-in-tickets-getmilestone-endpoint"},{"cve":"CVE-2026-15510","cvss":6.3,"slug":"cve-2026-15510-leantime-improper-authorization-in-setting-savesetting-api","title":"Leantime improper authorization in Setting::saveSetting API","severity":"medium","exploited":false,"published_at":"2026-07-12T23:16:37.977+00:00","url":"https://junglewise.ai/threats/cve-2026-15510-leantime-improper-authorization-in-setting-savesetting-api"},{"cve":"CVE-2026-15509","cvss":6.3,"slug":"cve-2026-15509-leantime-privilege-escalation-in-json-rpc-edituser-and-adduser","title":"Leantime privilege escalation in JSON-RPC editUser and addUser","severity":"medium","exploited":false,"published_at":"2026-07-12T23:16:37.817+00:00","url":"https://junglewise.ai/threats/cve-2026-15509-leantime-privilege-escalation-in-json-rpc-edituser-and-adduser"},{"cve":"CVE-2026-66414","cvss":6.1,"slug":"cve-2026-66414-leantime-open-redirect-in-login-controller","title":"Leantime open redirect in Login controller","severity":"medium","exploited":false,"published_at":"2026-07-30T17:16:34.21+00:00","url":"https://junglewise.ai/threats/cve-2026-66414-leantime-open-redirect-in-login-controller"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Leantime","slug":"leantime","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/leantime"}]}