CVE-2026-85990

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.10.0

Description The JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods because PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. An authenticated user with low privileges can send an X-Requested-With: XMLHttpRequest header to call the leantime.rpc.api.api.createApiKeyWithProjects method, which triggers Api::createApiKeyWithProjects(), allowing the creation of an interactive administrator account by specifying a chosen role. Additionally, this lack of authorization exposes the following functions to ordinary authenticated users, enabling unauthorized plugin management: Plugins::installPlugin(), Plugins::enablePlugin(), Plugins::disablePlugin(), and Plugins::removePlugin().

Recommendations Update to version 3.10.0.