CVE-2026-54418: Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Leantimeto a version that resolves this vulnerability.Fixed in 3.6.2 - Configuration
Update the JSON-RPC dispatcher/method handlers so these TwoFA JSON-RPC methods enforce caller authorization for the userId parameter (add ownership check, permission-attribute gating, and session pinning), rather than acting on caller-supplied userId without access control.
Leantime JSON-RPC (leantime.rpc.TwoFA.TwoFA.*) Authorization/ownership checks for caller-supplied userId = Require ownership check + permission-attribute gate + session pinning for methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, disable2FA
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54418?
The severity of CVE-2026-54418 is rated as high with a score of 8.1.
What does CVE-2026-54418 affect?
CVE-2026-54418 affects Leantime versions up to 3.6.2 and involves missing authorization on specific JSON-RPC methods.
How do I fix CVE-2026-54418?
To fix CVE-2026-54418, upgrade to the latest version of Leantime that includes the necessary authorization checks.
What are the risks associated with CVE-2026-54418?
The risks associated with CVE-2026-54418 include potential cross-account 2FA secret disclosure and bypass.
What specific methods are impacted by CVE-2026-54418?
The impacted methods by CVE-2026-54418 include leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA.