CVE-2026-54418

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.6.3

Description Authenticated users can exploit a missing authorization check in the JSON-RPC dispatcher. The application fails to implement ownership checks, session pinning, or permission-attribute gates for specific methods. An attacker can provide an arbitrary userId to the following endpoints:

By manipulating the userId parameter, an attacker can read another user's live Time-based One-Time Password (TOTP) secret via getSetupData or completely disable two-factor authentication for another account using disable2FA, effectively bypassing account-level 2FA protections.

Recommendations Update Leantime to version 3.6.3 or later. As a temporary mitigation, restrict access to the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, leantime.rpc.TwoFA.TwoFA.saveSecret, leantime.rpc.TwoFA.TwoFA.verifyAndEnable, and leantime.rpc.TwoFA.TwoFA.disable2FA.