Missing Authorization Vulnerability in Leantime's JSON-RPC API

CVE-2026-76647

What is CVE-2026-76647?

The Leantime JSON-RPC API up to version 3.9.0 is susceptible to a missing authorization vulnerability in its JSON-RPC dispatcher. This flaw allows authenticated users to call service-layer methods without proper authorization checks, potentially leading to unauthorized actions on resources. Specifically, the dispatcher does not confirm the legitimacy of the user ID supplied in the editOwn method, enabling a threat actor to manipulate another user's account, such as updating passwords and gaining complete control. This issue stems from a failure to implement centralized authorization enforcement in the dispatcher rather than isolated methodological behaviors.

References