CVE-2026-94210 in Leantime
Summary
by MITRE • 09/21/2026
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in Hyve5 Leantime versions up to 3.9.8 represents a significant security risk within the application's Kanban Board component. Specifically, the flaw resides in the getAllGrouped function located in the file app/Domain/Tickets/Services/Tickets.php. This defect allows for cross-site scripting attacks, which are among the most prevalent and dangerous web application vulnerabilities due to their ability to compromise user sessions and steal sensitive data without direct interaction with server-side resources. The presence of an available exploit indicates that this vulnerability is not merely theoretical but can be actively leveraged by threat actors in real-world scenarios against unpatched instances.
Cross-site scripting, commonly referred to as XSS, occurs when an application includes untrusted data in a web page without proper validation or escaping. In the context of Leantime's Kanban Board, the getAllGrouped function likely processes input parameters related to ticket grouping or board configuration and injects them into the HTML response sent to the client browser. If these inputs contain malicious JavaScript code rather than expected alphanumeric characters, the browser will execute this script in the context of the current user session. This behavior aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as a critical weakness allowing for injection attacks. The specific mechanism here suggests that input validation is either absent or insufficiently strict within the ticket grouping logic, permitting special characters and script tags to pass through to the frontend rendering engine.
The operational impact of this vulnerability is severe because it enables remote exploitation by any authenticated user who can manipulate the parameters passed to the getAllGrouped function. An attacker could craft a malicious URL or payload that triggers the vulnerable code path when another user views their board or ticket list. Once executed, the injected script runs with the privileges of the victim's session. This allows the attacker to perform actions on behalf of the victim, such as changing account settings, modifying tickets, or exfiltrating sensitive project data and credentials stored in local storage or cookies. Furthermore, because Leantime is a collaborative project management tool, compromising one user can potentially lead to broader organizational intelligence gathering if multiple team members interact with the compromised view. This aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript-based execution, which describes how attackers use scripts embedded in web pages to execute malicious commands within a victim's browser environment.
The availability of an exploit further elevates the urgency of addressing this issue. Automated scanning tools and threat actors frequently utilize known exploits to identify vulnerable instances across the internet. Since the vulnerability is remote exploitable, there is no need for physical access or complex social engineering beyond tricking a user into visiting a crafted link or viewing a manipulated board view. The persistence of such flaws in widely used open-source project management software highlights the importance of rigorous code review and input sanitization practices during development. Developers must ensure that all data rendered to the client is properly encoded according to the context, whether it be HTML entity encoding for text content or attribute escaping for dynamic attributes within the DOM structure.
To mitigate this risk, immediate deployment of patch a30a6837b4071ac05a4f58d0e1baa2c62aa8695e is strongly recommended by the vendor and security experts alike. This patch addresses the underlying code flaw in the Tickets.php service file, ensuring that inputs are validated and sanitized before being processed or rendered. Administrators should apply this update to all production instances of Leantime running version 3.9.8 or earlier. In addition to applying the patch, organizations should implement defense-in-depth strategies such as Content Security Policy headers to restrict the execution of inline scripts where possible. Regular security audits and penetration testing focused on input validation in web forms and API endpoints can help identify similar weaknesses before they are exploited. Maintaining an up-to-date software inventory and monitoring vendor advisories ensures that future vulnerabilities affecting Leantime or its dependencies are addressed promptly, reducing the window of exposure to potential attackers leveraging this class of vulnerability.