CVE-2026-76647

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.

• CWE-200
• CWE-639
• CWE-862

• https://leantime.io/unlocking-leantimes-power-a-guide-to-the-json-rpc-api/
• https://vokecyber.com/blog/leantime-jsonrpc-editown-account-takeover
• https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover
• https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover

Published

Aug 19, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76639Unitree G1 EDU firmware through 1.5.2 contains an unauthenti…8.8
• CVE-2026-7664IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthentic…9.8
• CVE-2026-76640Unitree G1 EDU firmware through 1.5.2 contains multiple chai…7.5
• CVE-2026-76641Expat through 2.8.3 contains an out-of-bounds read vulnerabi…7.5
• CVE-2026-76642util-linux versions through 2.41.5 and 2.42.2 fail to check …7.8
• CVE-2026-76646A remote attacker could cause excessive resource consumption…7.5
• CVE-2026-76648CopyAPIView (awx/awx/api/generics.py:873) sets permission_cl…8.5
• CVE-2026-76649A NULL pointer dereference vulnerability exists in TL-WR841N…5.3
• CVE-2026-7665The Essential Addons for Elementor – Popular Elementor Templ…5.3
• CVE-2026-76650A NULL pointer dereference vulnerability exists in TL-WR841N…5.3
• CVE-2026-76651A buffer overflow vulnerability exists in the embedded HTTP …5.3
• CVE-2026-76652An authenticated directory traversal vulnerability in file u…4.8