CVE-2026-76647: Leantime JSON-RPC API contains a missing authorization vulnerability
Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Leantime JSON-RPC API. The missing dispatcher-level authorization checks may let that user invoke methods or operate on resources beyond their assigned permissions.
What is the demonstrated impact?
The editOwn method accepts a caller-supplied user ID without confirming it belongs to the authenticated caller. An authenticated attacker can use this to modify another user account and set a new password, resulting in account takeover.
Which versions are affected?
The issue affects the Leantime JSON-RPC API through version 3.9.0.