CVE-2026-15510: Leantime API saveSetting improper authorization
Published Jul 12, 2026
·Updated
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
1 affected component
Leantime Leantime API<=3.8.0
Event History
Jul 12, 2026
CVE Published
via MITRE·10:45 PM
Data Sourced
via MITRE·10:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-15510?
CVE-2026-15510 has a medium severity rating of 6.3.
2
What is the risk associated with CVE-2026-15510?
CVE-2026-15510 has a risk score of 46.
3
How do I fix CVE-2026-15510?
To fix CVE-2026-15510, update your Leantime instance to version 3.8.1 or later.
4
What component is affected by CVE-2026-15510?
CVE-2026-15510 affects the Setting::saveSetting function of the Leantime API.
5
Can CVE-2026-15510 be exploited remotely?
Yes, CVE-2026-15510 can be exploited remotely due to improper authorization.