CVE-2026-59712: Leantime Information Disclosure Flaw

CVE-2026-59712 Overview

CVE-2026-59712 is a broken access control vulnerability [CWE-639] in Leantime, an open-source project management platform. The Users::getUser method exposed through the JSON-RPC API lacks proper authorization checks. Any authenticated user can call users.getUser with arbitrary user IDs and retrieve full credential rows from the zp_user table. Returned fields include bcrypt password hashes, plaintext TOTP secrets, session tokens, and password-reset tokens.

Critical Impact
Authenticated attackers can enumerate every account in a Leantime instance, harvest password hashes for offline cracking, bypass two-factor authentication using leaked TOTP seeds, and hijack active sessions via exposed session tokens.

Affected Products

Leantime project management application
Leantime JSON-RPC API endpoint (users.getUser method)
Leantime versions prior to the fix in commit 4f2612d

Discovery Timeline

2026-07-06 - CVE-2026-59712 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59712

Vulnerability Analysis

The vulnerability resides in Leantime's Users service, which backs the users.getUser JSON-RPC method. The method resolves a user ID supplied by the caller and returns the raw repository row from zp_user without filtering sensitive columns. According to the patch notes, the getUser endpoint is intentionally ungated so internal view composers can call it, but the API surface received the same unfiltered payload. Any authenticated session, including low-privileged accounts, can iterate user IDs and dump credentials for the entire tenant.

Root Cause

The root cause is missing authorization and missing output filtering on an API method that returns database rows verbatim. The service layer did not distinguish between internal callers and external API callers, so sensitive fields including password, twoFASecret, session, sessiontime, pwReset, pwResetExpiration, and pwResetCount were serialized into JSON-RPC responses. This maps to CWE-639, Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker with any authenticated Leantime account issues JSON-RPC calls to the users.getUser method while incrementing the id parameter. Each response contains a full user record including credential material. Password hashes feed offline cracking with tools like Hashcat. Leaked TOTP seeds allow the attacker to generate valid second-factor codes. Leaked session tokens permit direct session hijacking without needing credentials at all.

php

// Security patch in app/Domain/Users/Services/Users.php
// Source: https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671

            return $this->userCache[$resolvedId];
        }

-        $user = $this->userRepo->getUser($resolvedId);
+        $user = $this->stripSensitiveUserFields($this->userRepo->getUser($resolvedId));
        $this->userCache[$resolvedId] = $user;

        return $user;
    }

+    /**
+     * Fields on the zp_user row that must never reach an API caller: the
+     * bcrypt password, the plaintext TOTP seed, the session token, and the
+     * password-reset token/metadata.
+     *
+     * @see https://github.com/Leantime/leantime/issues/3556
+     */
+    private const SENSITIVE_USER_FIELDS = [
+        'password',
+        'twoFASecret',
+        'session',
+        'sessiontime',
+        'pwReset',
+        'pwResetExpiration',
+        'pwResetCount',
+    ];

Detection Methods for CVE-2026-59712

Indicators of Compromise

Repeated JSON-RPC POST requests to the Leantime API endpoint invoking the users.getUser method with sequential or enumerated id values.
Application logs showing a single authenticated session retrieving many distinct user records within a short time window.
Unexpected successful logins from new IP addresses shortly after users.getUser enumeration activity, indicating session token or credential reuse.

Detection Strategies

Inspect Leantime web server access logs for POST requests to the JSON-RPC endpoint containing the string users.getUser and correlate by source IP and session.
Alert when a single user account triggers more than a handful of users.getUser calls in a short interval, which is atypical for normal UI usage.
Review authentication logs for successful logins that occur without a preceding password reset or MFA challenge, indicating session hijack via leaked tokens.

Monitoring Recommendations

Enable verbose API request logging on the Leantime application and forward logs to a centralized SIEM for retention and correlation.
Baseline normal usage of the users.getUser method per role and create anomaly detection rules on volume and diversity of accessed IDs.
Monitor for outbound traffic from hosts that recently queried the JSON-RPC API, which may indicate exfiltration of harvested credentials.

How to Mitigate CVE-2026-59712

Immediate Actions Required

Upgrade Leantime to a version that includes the fix from commit 4f2612d13e0e8a2093092a846b44506cf133b671, which strips sensitive fields from getUser API responses.
Force a password reset for every Leantime user account, since password hashes may already have been exfiltrated for offline cracking.
Rotate all TOTP secrets by requiring users to re-enroll their authenticator applications, invalidating any leaked seeds.
Invalidate all existing sessions by rotating the application session secret and clearing the zp_user.session column so leaked tokens cannot be replayed.

Patch Information

The fix is delivered in Leantime commit 4f2612d13e0e8a2093092a846b44506cf133b671, referenced by GitHub issue #3556 and pull request #3576. The patch introduces a stripSensitiveUserFields method in app/Domain/Users/Services/Users.php that removes password, twoFASecret, session, sessiontime, pwReset, pwResetExpiration, and pwResetCount before returning user records to API callers. See the VulnCheck Advisory on Leantime for additional context.

Workarounds

Restrict network access to the Leantime JSON-RPC endpoint using a reverse proxy or web application firewall rule that blocks requests targeting the users.getUser method until patching is complete.
Temporarily disable low-privilege and self-registration accounts, limiting API access to trusted administrators only.
Apply the diff from commit 4f2612d manually to app/Domain/Users/Services/Users.php if a full upgrade is not immediately possible.

bash

# Configuration example: pull the fix and redeploy Leantime
git fetch origin
git checkout 4f2612d13e0e8a2093092a846b44506cf133b671 -- app/Domain/Users/Services/Users.php app/Domain/Users/Controllers/EditUser.php

# Rebuild and restart the application
composer install --no-dev --optimize-autoloader
php artisan config:clear && php artisan cache:clear
systemctl restart php-fpm nginx

# Invalidate leaked session tokens at the database layer
mysql -u leantime -p leantime -e "UPDATE zp_user SET session = NULL, sessiontime = NULL;"