{"id":"CVE-2026-85990","published":"2026-10-13T17:17:47.707","lastModified":"2026-10-16T23:17:02.333","description":"Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02","tags":[]},{"url":"https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e","tags":[]},{"url":"https://github.com/Leantime/leantime/pull/3583","tags":[]},{"url":"https://github.com/Leantime/leantime/pull/3797","tags":[]},{"url":"https://github.com/Leantime/leantime/releases/tag/v3.10.0","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]}],"exploitRefs":[{"url":"https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02","tags":[]},{"url":"https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e","tags":[]},{"url":"https://github.com/Leantime/leantime/pull/3583","tags":[]},{"url":"https://github.com/Leantime/leantime/pull/3797","tags":[]},{"url":"https://github.com/Leantime/leantime/releases/tag/v3.10.0","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]},{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp","tags":[]}],"hasPoc":true,"ai":{"summary":"A low-privilege authenticated user can escalate privileges to administrator by creating a new admin account and gain unauthorized access to plugin management functions. This allows attackers to install, enable, disable, or remove plugins without proper authorization.","exploitability":"Exploitation is straightforward requiring only an authenticated browser session with the X-Requested-With: XMLHttpRequest header, making it relatively easy to exploit with minimal prerequisites.","blast_radius":"The impact could be significant as attackers can create administrator accounts and manipulate plugins, potentially leading to full system compromise through malicious plugin installations or privilege escalation attacks.","remediation":"Upgrade to version 3.10.0 which contains the complete fix for the permission enforcement issues in the JSON-RPC dispatcher and plugin management functions.","detection":"Monitor for unauthorized API calls to leantime.rpc.api.api.createApiKeyWithProjects endpoint and plugin management methods (installPlugin, enablePlugin, disablePlugin, removePlugin) in application logs, particularly when initiated by low-privilege users.","tags":["privilege-escalation","plugin-management","api"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:08:45.014Z"}}