CVE-2026-15509

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.8.1

Description Improper authorization occurs within the JSON-RPC Endpoint component when the role argument is manipulated in the editUser() or addUser() functions. This allows a remote attacker to bypass authorization controls.

Recommendations As a temporary workaround, restrict access to the editUser() and addUser() functions within the JSON-RPC Endpoint until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.