CVE-2026-15510: Leantime Auth Bypass Vulnerability

CVE-2026-15510 Overview

CVE-2026-15510 is a broken access control vulnerability in Leantime versions up to 3.8.0. The flaw resides in the Setting::saveSetting function of the API component. Authenticated remote attackers can invoke this function without the authorization checks required for privileged configuration changes, mapping to [CWE-266] Incorrect Privilege Assignment.

The exploit has been published, and the vendor did not respond to disclosure attempts. Because the affected function modifies application settings, successful exploitation impacts confidentiality, integrity, and availability at a limited scope.

Critical Impact
Authenticated remote attackers can modify Leantime settings through the API by abusing improper authorization in Setting::saveSetting, altering application behavior for other users.

Affected Products

Leantime versions up to and including 3.8.0
Leantime API component (Setting::saveSetting function)
Deployments exposing the Leantime API to authenticated low-privilege users

Discovery Timeline

2026-07-12 - CVE-2026-15510 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15510

Vulnerability Analysis

The vulnerability affects the Setting::saveSetting function within Leantime's API component. This function persists configuration values but fails to enforce sufficient authorization on the caller. Any authenticated user can therefore write settings that should be restricted to administrators.

The weakness is categorized under [CWE-266] Incorrect Privilege Assignment. The API exposes privileged operations to accounts that hold only baseline credentials. Attackers with a low-privilege session can issue crafted API requests to overwrite settings that influence how other users interact with the application.

Because the flaw is reachable over the network and requires only a valid user session, it lowers the bar for post-authentication tampering. The exploit code is publicly available, according to the Bytium Access Control Insight and VulDB CVE-2026-15510 references.

Root Cause

The root cause is a missing authorization check inside Setting::saveSetting. The function accepts and persists setting keys and values without validating that the caller holds the administrative role required to change global configuration. Role gating is expected at the API boundary but is absent for this handler.

Attack Vector

An attacker authenticates to Leantime with any valid account, including a low-privilege standard user. The attacker then submits an API request that reaches Setting::saveSetting with attacker-controlled keys and values. Leantime writes the values into its settings store, applying them to the affected users. No user interaction is required beyond the attacker's own session.

No verified proof-of-concept code is included here. Technical details are documented in the Bytium Access Control Insight advisory.

Detection Methods for CVE-2026-15510

Indicators of Compromise

Unexpected changes to Leantime application settings recorded in the database or audit logs.
API requests targeting the settings save endpoint from user accounts that are not administrators.
Repeated POST requests to Leantime API routes containing setting keys from non-administrative sessions.

Detection Strategies

Enable and centralize Leantime application and web server logs, then alert on writes to the settings endpoint from non-admin user IDs.
Baseline the set of accounts that legitimately modify configuration, and flag deviations from that baseline.
Correlate authentication events with subsequent settings modifications to identify low-privilege accounts issuing administrative API calls.

Monitoring Recommendations

Forward Leantime web server and PHP application logs to a centralized log platform for retention and query.
Monitor for HTTP 200 responses to settings API calls originating from unprivileged session tokens.
Track anomalies in configuration change frequency, especially outside normal maintenance windows.

How to Mitigate CVE-2026-15510

Immediate Actions Required

Restrict network access to the Leantime API so it is reachable only from trusted networks or via VPN.
Audit existing Leantime settings against a known-good baseline and revert any unauthorized changes.
Review recent user account creation and disable low-privilege accounts that are not required.

Patch Information

No vendor patch is referenced in the available disclosure data. According to the CVE description, the vendor was contacted about this disclosure but did not respond. Monitor the Bytium Access Control Insight writeup and the upstream Leantime project for future security releases addressing Setting::saveSetting.

Workarounds

Limit account provisioning in Leantime to trusted users while no fixed release is available.
Place Leantime behind a web application firewall or reverse proxy that restricts settings API paths to administrator source IPs.
Apply the principle of least privilege by removing unused accounts and enforcing strong authentication for remaining users.

bash

# Example nginx snippet restricting the Leantime settings API path to trusted admin IPs
location ~* /api/.*setting {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://leantime_backend;
}