CVE-2026-76647: Leantime JSON-RPC Auth Bypass Vulnerability

CVE-2026-76647 Overview

CVE-2026-76647 is a missing authorization vulnerability in the Leantime JSON-RPC API through version 3.9.0. The flaw resides in the JSON-RPC dispatcher at app/Domain/Api/Controllers/Jsonrpc.php, which invokes service-layer methods without enforcing authorization on the caller. An authenticated user can call methods or act on resources outside their intended permissions. The editOwn method, for example, accepts a user-supplied user ID without verifying ownership, allowing an attacker to modify another user's account and set a new password. This results in full account takeover, including takeover of administrative accounts.

Critical Impact
Any authenticated Leantime user can hijack arbitrary accounts, including administrators, by calling editOwn through the JSON-RPC dispatcher with another user's ID.

Affected Products

Leantime through version 3.9.0
Leantime JSON-RPC API endpoint (app/Domain/Api/Controllers/Jsonrpc.php)
Deployments exposing the JSON-RPC dispatcher to authenticated users

Discovery Timeline

2026-08-19 - CVE-2026-76647 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76647

Vulnerability Analysis

Leantime is an open-source project management platform that exposes a JSON-RPC 2.0 API for programmatic access to domain services. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php maps incoming JSON-RPC method names to service-layer classes and invokes them dynamically. The dispatcher does not perform any authorization check to confirm the caller is permitted to invoke the target method or act on the referenced resource.

This missing check turns the entire JSON-RPC surface into a horizontal and vertical privilege escalation channel. Any authenticated user, including the lowest privileged role, can reach service methods intended for other users or higher-privileged roles. This CVE is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the dispatcher itself, not any single exposed method.

Root Cause

The root cause is the absence of centralized authorization enforcement in the JSON-RPC dispatcher. Service methods rely on caller-supplied parameters, such as a user ID, without validating that the parameter matches the authenticated session. Methods named with an Own suffix, such as editOwn, imply ownership scoping, but the dispatcher performs no verification that the target ID belongs to the caller.

Attack Vector

An attacker with any valid Leantime session sends a JSON-RPC request to the dispatcher, invoking editOwn with the target victim's user ID and an attacker-controlled password. The dispatcher forwards the call to the user service, which updates the specified account. The attacker then authenticates as the victim, including as an administrator, and inherits full account privileges. Refer to the Voke Cyber research writeup for a detailed walkthrough of the request structure.

No verified exploit code is published in the enriched data. See the Leantime JSON-RPC API guide for the API request format used in exploitation.

Detection Methods for CVE-2026-76647

Indicators of Compromise

JSON-RPC requests to /api/jsonrpc invoking editOwn with a userId that does not match the authenticated session user
Unexpected password change events on accounts that did not initiate a reset workflow
New administrator logins from IP addresses or user agents not previously associated with those accounts
Bursts of JSON-RPC calls from a single low-privileged session touching multiple user IDs

Detection Strategies

Parse Leantime web server access logs for POST requests to the JSON-RPC endpoint and correlate the method field with the authenticated session identity
Alert when a session issues editOwn calls referencing a userId that differs from the session owner
Baseline normal JSON-RPC method usage per role and flag calls to service methods outside that baseline

Monitoring Recommendations

Enable verbose application logging on the JSON-RPC controller to capture method name, caller session, and parameter payloads
Forward Leantime web and application logs to a centralized log platform for retention and correlation across users
Monitor the Leantime users table for unexpected password or role column updates

How to Mitigate CVE-2026-76647

Immediate Actions Required

Upgrade Leantime to a release later than 3.9.0 that patches the JSON-RPC dispatcher once the vendor publishes it
Restrict network access to the JSON-RPC endpoint using a reverse proxy or WAF rule that limits it to trusted internal callers
Force a password reset for all Leantime accounts, prioritizing administrators, if exposure is suspected
Audit the users table for unauthorized changes to email addresses, passwords, or roles

Patch Information

The enriched data does not list a specific fixed version or vendor advisory URL. Monitor the Leantime project releases and the vendor's security channels for a fixed build after 3.9.0. Any fix should introduce centralized authorization enforcement in app/Domain/Api/Controllers/Jsonrpc.php before service-layer dispatch.

Workarounds

Block or firewall the /api/jsonrpc route at the reverse proxy for user roles that do not require API access
Apply a WAF rule that inspects JSON-RPC bodies and rejects editOwn requests where the userId parameter does not match the authenticated session
Disable the JSON-RPC API entirely if it is not used, by removing or protecting the controller route
Enforce short session lifetimes and multi-factor authentication on the login flow to limit exposure of stolen credentials

bash

# Example nginx snippet restricting JSON-RPC to an internal admin network
location = /api/jsonrpc {
    allow 10.0.0.0/24;
    deny  all;
    proxy_pass http://leantime_backend;
}