CVE-2026-66416: Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Leantimeto a version that resolves this vulnerability.Fixed in 3.6.2 - Configuration
Ensure Laravel VerifyCsrfToken middleware is included in the global middleware stack in app/Http/Kernel.php so CSRF protection is applied to state-changing POST/PUT/DELETE requests.
Leantime (Laravel) app/Http/Kernel.php VerifyCsrfToken middleware in global middleware stack = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66416?
CVE-2026-66416 has a high severity score of 8.8.
How do I fix CVE-2026-66416?
To fix CVE-2026-66416, ensure that the Laravel VerifyCsrfToken middleware is included in the global middleware stack in app/Http/Kernel.php.
What type of vulnerability is CVE-2026-66416?
CVE-2026-66416 is a cross-site request forgery (CSRF) vulnerability.
Who is affected by CVE-2026-66416?
CVE-2026-66416 affects users of Leantime version 3.6.2 that have not implemented adequate CSRF protection.
What are the potential impacts of CVE-2026-66416?
Exploitation of CVE-2026-66416 allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users.