CVE-2026-85990

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Published Oct 13, 2026 · corrected/updated Oct 15, 2026 · Leantime leantime · evidence confidence high

### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-method authorization on JSON-RPC-exposed service methods) also leaves the service's , , , and methods callable by any authenticated user with no role check, even though their web-UI equivalents correctly require an admin/owner role. ### Details Leantime's JSON-RPC API ( ) reflects any public method on any -annotated service class and dispatches it at . Per-method authorization is enforced by ( ), which reads a PHP attribute off the target method - but when that attribute is **absent**, silently returns and allows the call through. ( ) is -exposed and carries no attribute. It forwards - including a caller-supplied - directly into → , with no server-side clamping of against the calling user's own privilege level: The equivalent web route ( controller) correctly gates account creation behind an admin-only role check ( ), but that gate is bypassed entirely by calling the service directly through JSON-RPC. Separately, , , , and ( , lines ~266/299/320/342) share the same gap: all four are -exposed with no , while their web-controller equivalents ( , ) correctly require / . Authenticating to the JSON-RPC endpoint with an ordinary browser session cookie (rather than a dedicated API key) is sufficient, provided the request carries an header ( ) - this is exactly what the application's own first-party JS client already sends, so no special tooling beyond a normal authenticated session is needed. ### PoC A runnable Python PoC ( library only) reproduces this end-to-end; see the attached . Steps: 1. Create/authenticate as a -role account (the lowest privilege level). Confirm it is correctly

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-85990 is a high public vulnerability record for Leantime leantime. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether Leantime leantime is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: leantime/leantime (0 → 3.10.0); leantime; Leantime leantime. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 8.8. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-269, CWE-862. Sources contributing to this record: cve_org, github, gitlab, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 15, 2026 · GitHub Advisory Database
Detected
### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth
Oct 15, 2026 · GitHub Advisory Database
Fix available
leantime/leantime fixed in 3.10.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
leantime/leantime fixed in 3.10.0
Oct 15, 2026 · GitHub Advisory Database
Updated
### Summary Any authenticated Leantime user - including the lowest-privilege role - can escalate to full administrative access by calling the JSON-RPC method with an attacker-chosen value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-meth

Affected

Packagist leantime/leantime0 → 3.10.0
composer leantimeversion unspecified
vendor Leantime leantimeversion unspecified

Sources

CVE.orgVulnerability recordCVE-2026-85990
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnfor
cve.org
GitHub Advisory DatabasePackage advisoryGHSA-54mm-6729-r5wp
GitHub Advisory Database record mirrored by OSV.
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-85990
Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordina
advisories.gitlab.com
OSV.devPackage advisoryGHSA-54mm-6729-r5wp
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
osv.dev