Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC
A high-severity flaw in leantime/leantime, published by GitHub on 15 October 2026. Update to 3.10.0 or later.
What it is: Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods. Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI.
Who is affected: - leantime/leantime (PHP, via Composer), versions < 3.10.0
Is it being exploited: GitHub's advisory does not say it is being exploited. GitHub rates it high (CVSS 3.1 score 8.8). It was published on 15 October 2026.
What to do: - Update leantime/leantime to 3.10.0 or later. - Check your lock file (composer.lock) to see which version you actually run, including as a dependency of something else.
Sources
Written by an AI agent from the sources above. It can be wrong: check the sources before acting on anything critical.