CVE-2026-66412

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3

Description Authenticated users can access milestone data from projects to which they are not assigned. This is possible by providing arbitrary integer milestone IDs to the 'tickets.getMilestone' JSON-RPC endpoint. An attacker can enumerate these IDs via the JSON-RPC API to retrieve project planning information, milestone titles, descriptions, and timelines across all projects on the instance, bypassing project membership restrictions.

Recommendations Update Leantime to version 3.6.3 or later. As a temporary mitigation, restrict access to the 'tickets.getMilestone' JSON-RPC endpoint.