CVE-2026-66412: Leantime Auth Bypass Vulnerability

CVE-2026-66412 Overview

CVE-2026-66412 is a broken access control vulnerability in Leantime versions 3.6.2 and prior. The flaw resides in the tickets.getMilestone JSON-RPC endpoint, which fails to verify that the requesting user belongs to the project associated with a milestone. Authenticated users can enumerate integer milestone IDs and retrieve milestone titles, descriptions, and timelines from projects they are not assigned to. The vulnerability is classified as an Insecure Direct Object Reference [CWE-639] and affects confidentiality of cross-project planning data.

Critical Impact
Any authenticated Leantime user can read milestone data from every project on the instance by supplying arbitrary integer IDs to the JSON-RPC endpoint.

Affected Products

Leantime 3.6.2
Leantime versions prior to 3.6.2
Leantime tickets.getMilestone JSON-RPC endpoint

Discovery Timeline

2026-07-27 - CVE-2026-66412 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66412

Vulnerability Analysis

The vulnerability affects the getMilestone(int $id) method inside app/Domain/Tickets/Services/Tickets.php. The method exposes milestone records through the JSON-RPC API and requires only the generic TicketsPermissions::VIEW permission. It never checks whether the authenticated user belongs to the project the milestone is attached to.

An authenticated attacker submits a JSON-RPC request specifying an integer milestone id. The service returns the full milestone record, including title, description, and schedule. Because milestone IDs are sequential integers, an attacker can iterate through IDs and harvest planning data across every tenant project on the instance.

Root Cause

The root cause is a missing authorization check between authentication and data retrieval. The permission attribute on getMilestone() validates only that the caller can view tickets in principle, not that the caller is a member of the target project. The repository call getTicket($id) returns any milestone by primary key, so the absence of a project-membership check produces a classic Insecure Direct Object Reference [CWE-639].

Attack Vector

Exploitation requires network access to the JSON-RPC endpoint and any valid Leantime account. No user interaction is required. The attacker enumerates integer milestone IDs, issues tickets.getMilestone calls, and reads the returned records. A public proof of concept is available on GitHub, and the vulnerability can be scripted for bulk extraction.

php

     *
     * @api
     */
-    #[RequiresPermission(TicketsPermissions::VIEW)]
+    #[RequiresPermission(TicketsPermissions::VIEW, projectIdParam: 'id')]
    public function getMilestone(int $id): TicketModel|bool
    {
-        return $this->ticketRepository->getTicket($id);
+        $milestone = $this->ticketRepository->getTicket($id);
+
+        // Verify the user is assigned to the milestone's project.
+        // Mirrors the authorization check in getTicket().
+        if ($milestone && $this->projectService->isUserAssignedToProject(session('userdata.id'), $milestone->projectId)) {
+            return $milestone;
+        }
+
+        return false;
    }

Source: Leantime security patch commit 68898ee

Detection Methods for CVE-2026-66412

Indicators of Compromise

Repeated JSON-RPC requests invoking the tickets.getMilestone method with sequentially incrementing integer id values.
Authenticated sessions issuing milestone lookups for projectId values that the user is not assigned to.
High-volume outbound JSON-RPC traffic from a single account within a short time window, indicative of ID enumeration.

Detection Strategies

Enable application-level logging for JSON-RPC calls and alert on tickets.getMilestone requests that reference milestone IDs outside the caller's project scope.
Correlate web server access logs with session identifiers to detect enumeration patterns against /api/jsonrpc or equivalent endpoints.
Baseline the number of milestone lookups per user per hour and flag statistical outliers.

Monitoring Recommendations

Monitor Leantime application logs for HTTP 200 responses to tickets.getMilestone where the resolved projectId is not present in the user's project membership table.
Track authenticated API traffic volume per account and alert when milestone reads exceed a normal working threshold.
Retain JSON-RPC request bodies for at least 90 days to support retrospective hunting once the patch is deployed.

How to Mitigate CVE-2026-66412

Immediate Actions Required

Upgrade Leantime to the version containing commit 68898ee, which adds the project ownership check to getMilestone().
Audit application logs for prior enumeration of tickets.getMilestone and identify accounts that accessed unassigned projects.
Rotate credentials for any user account observed enumerating milestone IDs and review project membership for anomalies.

Patch Information

The fix is delivered in Leantime commit 68898ee and merged through Leantime Pull Request #3657. Details are documented in the GitHub Security Advisory GHSA-wv69-xr82-phr6 and the VulnCheck Advisory. The patch attaches projectIdParam: 'id' to the RequiresPermission attribute and invokes projectService->isUserAssignedToProject() before returning milestone data.

Workarounds

Restrict access to the Leantime JSON-RPC endpoint at the reverse proxy or web application firewall until the patched version is deployed.
Limit account creation and reduce the population of authenticated users to trusted personnel while the vulnerability remains unpatched.
Apply the upstream diff manually to app/Domain/Tickets/Services/Tickets.php if an immediate version upgrade is not feasible.

bash

# Upgrade Leantime to a patched build
git fetch origin
git checkout main
git pull
git log --oneline | grep 68898ee
# Then rebuild and redeploy per your environment (composer install, docker compose up -d, etc.)