CVE-2026-15509: Leantime Auth Bypass Vulnerability

CVE-2026-15509 Overview

CVE-2026-15509 is an improper authorization vulnerability in Leantime versions up to 3.8.0. The flaw resides in the editUser and addUser functions of the JSON-RPC Endpoint component. Attackers can manipulate the role argument to escalate privileges beyond their authorized level. The attack is executed remotely over the network and requires only low-privileged authentication.

The issue is classified under [CWE-266: Incorrect Privilege Assignment]. Public disclosure has occurred, and exploit details are available. According to the reporter, the vendor was contacted but did not respond to the disclosure.

Critical Impact
A low-privileged authenticated user can escalate to owner-level access by manipulating the role parameter in JSON-RPC calls to editUser or addUser, gaining full administrative control over the Leantime instance.

Affected Products

Leantime versions up to and including 3.8.0
Leantime JSON-RPC Endpoint component
editUser and addUser function handlers

Discovery Timeline

2026-07-12 - CVE-2026-15509 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15509

Vulnerability Analysis

The vulnerability exists in Leantime's JSON-RPC Endpoint, which exposes the editUser and addUser functions to authenticated clients. The endpoint fails to enforce role-based authorization checks on the role argument passed in JSON-RPC requests. As a result, a user with low privileges can supply an elevated role value and bypass the intended access control model.

Because the vulnerability affects account management functions, successful exploitation grants attackers persistent, high-privileged access. This access can be used to read sensitive project data, modify records, invite additional accounts, and pivot within the application. The confidentiality, integrity, and availability impacts are each rated low individually, but the aggregate risk to a single tenant is elevation to owner-level control.

Root Cause

The root cause is a missing authorization check on the role parameter within the editUser and addUser handlers. The JSON-RPC layer trusts the caller-supplied role value instead of validating it against the requesting user's own privileges. This falls under [CWE-266] Incorrect Privilege Assignment, where the application assigns privileges without verifying the requester is entitled to grant them.

Attack Vector

An authenticated attacker with low privileges sends a crafted JSON-RPC request to the Leantime endpoint. The request invokes editUser or addUser with a role argument set to owner or another elevated role. The server processes the request without verifying the caller's authority to assign that role. The attacker's account, or a newly created account, gains elevated permissions.

The vulnerability manifests in the JSON-RPC parameter handling path. See the Bytium Vulnerability Insight and VulDB CVE-2026-15509 references for full technical details.

Detection Methods for CVE-2026-15509

Indicators of Compromise

JSON-RPC requests to the Leantime endpoint invoking editUser or addUser with a role value of owner, admin, or manager originating from accounts that previously held only editor or client roles.
Unexpected role changes in the Leantime user table, particularly self-assigned elevations or new owner-level accounts created outside normal onboarding workflows.
HTTP POST traffic to the JSON-RPC endpoint containing the method field set to leantime.rpc.users.editUser or leantime.rpc.users.addUser from low-privileged session tokens.

Detection Strategies

Enable verbose application logging for the JSON-RPC endpoint and alert on any successful role modification where the request originated from a non-administrative session.
Compare snapshots of the Leantime zp_user table against a known baseline to identify unauthorized role transitions.
Correlate authentication events with subsequent RPC calls to identify sessions that perform user-management actions inconsistent with their assigned role.

Monitoring Recommendations

Forward Leantime web server and application logs to a centralized SIEM or data lake for retention and search.
Build alert rules that trigger on JSON-RPC methods matching user-management operations from non-admin roles.
Monitor for the creation of new administrative accounts outside change-management windows.

How to Mitigate CVE-2026-15509

Immediate Actions Required

Restrict network access to the Leantime JSON-RPC endpoint to trusted management networks or authenticated VPN users until a patch is available.
Audit all existing Leantime user accounts and remove or downgrade any that hold owner or administrator roles without business justification.
Rotate credentials for all administrative accounts and enforce multi-factor authentication on the identity provider fronting Leantime.

Patch Information

At the time of publication, the Leantime maintainers had not responded to the disclosure and no official fix has been announced for versions up to 3.8.0. Monitor the Leantime project and the Bytium advisory for updates. Apply any security release as soon as it becomes available.

Workarounds

Place a reverse proxy or web application firewall in front of Leantime and block JSON-RPC requests whose payload contains a role parameter targeting editUser or addUser from non-administrative sessions.
Limit account creation to a small set of trusted administrators and disable self-service user registration where possible.
Review application logs daily for unauthorized role changes and revert any unexpected modifications immediately.

bash

# Example nginx rule to block JSON-RPC user role modifications from untrusted sources
location /api/jsonrpc {
    # Allow only management subnet
    allow 10.10.0.0/24;
    deny all;

    # Optional: block requests referencing role escalation methods
    if ($request_body ~* "(editUser|addUser).*role") {
        return 403;
    }

    proxy_pass http://leantime_backend;
}