CVE-2026-66412 in Leantime
Summary
by MITRE • 07/27/2026
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability represents a critical broken access control flaw in Leantime version 3.6.2 and earlier, classified under CWE-285 Access Control. The issue stems from insufficient authorization checks within the tickets.getMilestone JSON-RPC endpoint which accepts arbitrary integer milestone IDs as parameters. Authenticated users can exploit this weakness by enumerating milestone identifiers through the API to gain unauthorized access to sensitive project planning information including milestone titles, descriptions, and timelines from projects they do not belong to. The vulnerability operates at the application layer and specifically targets the API endpoint responsible for retrieving milestone data, making it particularly dangerous as it allows attackers to bypass normal project membership restrictions.
The operational impact of this vulnerability extends beyond simple information disclosure, creating a significant risk for organizations relying on Leantime for project management and planning. Attackers can systematically enumerate milestone IDs through API calls to discover and access confidential project timelines, deliverables, and strategic planning information across all projects within the instance. This enumeration capability enables adversaries to perform reconnaissance activities that could reveal business-critical information about project dependencies, resource allocation, and organizational priorities. The vulnerability affects the core authorization mechanisms of the platform, potentially exposing sensitive data that could be leveraged for further attacks or competitive intelligence gathering.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1213 Data from Information Repositories, where adversaries extract information from project management systems. The flaw allows attackers to perform unauthorized data access without requiring elevated privileges beyond basic authentication. This represents a privilege escalation risk that operates at the application level rather than network or system level attacks. Organizations using affected versions of Leantime face potential exposure of proprietary project planning information, timeline dependencies, and strategic business data that could be used for competitive advantage or social engineering attacks against team members.
The recommended remediation involves implementing proper input validation and access control checks within the tickets.getMilestone endpoint to verify that authenticated users have appropriate permissions before serving milestone data. The system should validate that requested milestone IDs correspond to projects where the user has legitimate access rights, typically through membership verification against project access controls. Additionally, implementing rate limiting and API call monitoring can help detect and prevent enumeration attacks by alerting administrators to suspicious activity patterns. Organizations should also consider implementing proper logging of access attempts to milestone data to enable forensic analysis if unauthorized access occurs. The fix must ensure that all JSON-RPC endpoints properly validate user permissions before returning sensitive project information, addressing the root cause through robust authorization controls rather than merely patching symptoms.