CVE-2026-59712: Leantime JSON-RPC Authorization Bypass Exposes User Credentials

Technical summary

The Users::getUser method in Leantime's JSON-RPC API performs insufficient authorization validation. While the endpoint requires authentication (PR:L), it fails to enforce object-level access controls, permitting any authenticated principal to retrieve full user credential rows for arbitrary user IDs. The exposure includes salted/hashed passwords, TOTP secrets (Base32-encoded shared keys), and valid session tokens. The lack of input validation on user ID parameters combined with missing authorization logic creates a horizontal privilege escalation vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key). Attackers can enumerate the entire user directory via sequential ID enumeration and harvest credentials offline.

Business impact

This vulnerability enables credential harvesting at scale. Attackers can obtain password hashes for offline cracking (reducing time-to-breach significantly with modern GPU clusters), bypass second-factor authentication by extracting TOTP secrets, and hijack active sessions to impersonate users without triggering failed login alerts. For organizations using Leantime to manage sensitive projects, this exposes not just authentication credentials but also organizational structure and user roles. The high CVSS score (8.1) reflects the combination of high confidentiality and integrity impact once credentials are compromised. Multi-factor authentication deployments provide no protection if TOTP secrets are extracted directly.

Affected systems

Leantime instances with the vulnerable JSON-RPC API enabled are affected. The vulnerability requires an attacker to first obtain valid authentication credentials (internal threat actor, compromised account, or credential stuffing). The vendor product list is empty in the source data; verify Leantime version ranges directly with the Leantime security advisory or GitHub repository to confirm which releases contain the fix.

Exploitability

Exploitation requires low complexity: an attacker needs only a valid Leantime user account (easily obtained via registration or credential compromise) and the ability to make HTTP requests to the JSON-RPC endpoint. No user interaction is needed, and the attack is fully automatable. The ability to enumerate user IDs (typically sequential or discoverable via directory features) makes large-scale credential extraction trivial. The CVSS vector AC:L reflects this accessibility. However, the PR:L requirement means external attackers cannot exploit this without first establishing a foothold—internal threats and credential compromise significantly lower the practical barrier.

Remediation

Apply the vendor patch immediately. Leantime must implement object-level authorization checks in the Users::getUser method, verifying that the requesting user has permission to retrieve data for the requested user ID (typically: admins only, or users may view only their own record). Input validation on user ID parameters should also be implemented. Organizations unable to patch immediately should disable the JSON-RPC API or restrict access to it via network controls (firewall rules limiting API endpoints to trusted networks). Rotate all user passwords and invalidate all active sessions post-patching. If TOTP secrets were exposed, users should re-enroll in two-factor authentication.

Patch guidance

Verify the patch version from the official Leantime security advisory or GitHub repository. Apply it during a maintenance window; patching does not require data migration but will invalidate existing sessions. Test the patch in a staging environment to confirm the JSON-RPC endpoint now properly rejects requests for user data outside the requesting user's scope. Post-patch, audit access logs to detect any prior credential enumeration attempts (look for sequential calls to users.getUser with different user IDs from the same source).

Detection guidance

Monitor JSON-RPC API logs for patterns consistent with credential enumeration: repeated calls to users.getUser with sequential or diverse user ID parameters from a single authenticated session over a short time window. Look for unusual calls to users.getUser originating from non-admin accounts. Inspect web server access logs for high-volume POST requests to the JSON-RPC endpoint from unexpected source IPs. Review authentication logs for concurrent sessions from the same user account accessing the API in quick succession. Consider alerting on any unauthenticated users attempting to call the endpoint (which should fail) as reconnaissance.

Why prioritize this

This is a HIGH-severity vulnerability requiring urgent patching. The low authentication barrier (any valid user can exploit it) combined with high confidentiality and integrity impact (exposure of password hashes, TOTP secrets, and session tokens) creates an immediate risk of large-scale credential compromise. The vulnerability enables multiple attack chains: offline password cracking, MFA bypass, and session hijacking. Organizations should treat this as a critical security event if Leantime is deployed. The absence of KEV status indicates active exploitation is not yet widely documented, but the straightforward nature of the attack and high impact make rapid patching essential before threat actors develop and distribute proof-of-concept code.

Risk score, explained

CVSS 8.1 (HIGH) is driven by: (1) high confidentiality impact (C:H)—exposure of password hashes, TOTP secrets, and session tokens, (2) high integrity impact (I:H)—session tokens enable account takeover and unauthorized actions, (3) no availability impact (A:N), (4) network-accessible attack vector (AV:N), (5) low attack complexity (AC:L), and (6) low privilege requirement (PR:L)—any authenticated user can exploit. The absence of user interaction (UI:N) and no scope change (S:U) complete the vector. The score reflects severe but not catastrophic risk; the organization's operations continue, but confidentiality and integrity are significantly compromised for all users.

Frequently asked questions