CVE-2026-66412

MEDIUM

Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-66412. PoCs published by javokhir-sec.

AI-analyzed exploit summary This repository contains detailed technical advisories for multiple vulnerabilities in Leantime <= 3.6.2, including SSRF/LFI via Blueprints import, IDOR for milestone access, open redirect, CSRF, and public CRON endpoints. The advisories include root cause analysis, vulnerable code snippets, PoC HTTP requests, and recommended fixes.

Description

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

Exploits (1)

nomisec WRITEUP 1 stars

by javokhir-sec · poc

https://github.com/javokhir-sec/CVE-PoC-Hub

View Code ZIP pw:eip

This repository contains detailed technical advisories for multiple vulnerabilities in Leantime <= 3.6.2, including SSRF/LFI via Blueprints import, IDOR for milestone access, open redirect, CSRF, and public CRON endpoints. The advisories include root cause analysis, vulnerable code snippets, PoC HTTP requests, and recommended fixes.

Classification

Writeup 98%

Attack Type

Complexity

Moderate

Reliability

Reliable

Target: Leantime <= 3.6.2

Auth required

Prerequisites: Authenticated session for most exploits (except public CRON) · Target running Leantime <= 3.6.2 · Network access to target

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1210 - Exploitation of Remote Services T1005 - Data from Local System T1083 - File and Directory Discovery T1078 - Valid Accounts

mistral-large-3 · analyzed Jul 27, 2026 Full analysis →

References (4)

Core 4

Core References

Vendor Advisory vendor-advisory

GitHub Security Advisory

https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6

Issue Tracking issue-tracking

Pull Request

https://github.com/Leantime/leantime/pull/3657

Patch patch

Patch Commit

https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae

View Patch ZIP pw:eip

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc

Scores

CVSS v3 6.5

EPSS 0.0024

EPSS Percentile 15.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

Leantime/Leantime < 3.6.2

Published Jul 27, 2026

Tracked Since Jul 27, 2026