CVE-2026-85990

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.

• CWE-269
• CWE-862

• https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02
• https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e
• https://github.com/Leantime/leantime/pull/3583
• https://github.com/Leantime/leantime/pull/3797
• https://github.com/Leantime/leantime/releases/tag/v3.10.0
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85981The administrative panel of the Auth0 AD/LDAP Connector (ver…6.7
• CVE-2026-85982The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Si…9
• CVE-2026-85983The Auth0 AD/LDAP Connector improperly processes a configura…7.8
• CVE-2026-85984The miniOrange OTP Login, Verification and SMS Notifications…9.8
• CVE-2026-85985MariaDB server is a community developed fork of MySQL server…5.4
• CVE-2026-8599The MailerPress – Email Marketing, Newsletter, Email Automat…6.4
• CVE-2026-85995Notepad++ is a free and open-source source code editor. From…7.3
• CVE-2026-85999Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86000Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86002Dokku is a docker-powered platform as a service. In Dokku ve…9
• CVE-2026-86003CoreDNS is a DNS server written in Go. Prior to 1.14.7, the …7.5
• CVE-2026-86008Mailu is a mail server distributed as a set of Docker images…7.2