CVE-2026-94211: Hyve5 Leantime XSS Vulnerability

CVE-2026-94211 Overview

CVE-2026-94211 is a stored cross-site scripting (XSS) vulnerability in Hyve5 Leantime through version 3.9.8. The flaw resides in the Project Dashboard component, specifically in /app/Domain/Dashboard/Templates/show.blade.php, where status label names are echoed to the browser without proper output encoding. An authenticated attacker holding EDIT permission on a project can plant a malicious payload in a status label. The payload then executes in the browser of any user who views the affected project dashboard, enabling cross-user impact and potential privilege escalation up to project owner.

Critical Impact
A user with EDIT permission can poison a status label to execute arbitrary JavaScript in every viewer's session, enabling account takeover paths against higher-privileged users.

Affected Products

Hyve5 Leantime versions up to and including 3.9.8
Project Dashboard component (show.blade.php)
Deployments that allow non-owner users to hold EDIT permission on projects

Discovery Timeline

2026-09-21 - CVE-2026-94211 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94211

Vulnerability Analysis

The vulnerability is a stored XSS (Cross-Site Scripting) issue classified under [CWE-79]. Leantime renders project status labels inside the dashboard Blade template /app/Domain/Dashboard/Templates/show.blade.php without applying HTML entity encoding. When a project editor sets a status label containing HTML or JavaScript, the raw content is placed directly into the DOM at render time.

The attack requires authentication and the EDIT permission on the target project. However, the payload fires in the browser session of any user who subsequently loads the project dashboard. This includes higher-privileged users such as project owners, which is the escalation path highlighted by the reporting researcher.

Root Cause

The root cause is missing output encoding on a user-controlled field. The template echoes the status label using a raw output construct rather than Blade's escaped {{ }} syntax, so no context-aware sanitization runs before the label reaches the browser.

Attack Vector

An authenticated user with EDIT permission modifies a project status label to include an HTML or JavaScript payload. When a victim navigates to the poisoned project's dashboard, the browser parses and executes the injected script under the victim's origin. The attacker can then perform actions on behalf of the victim, exfiltrate session tokens, or invoke API endpoints available to a project owner. Additional technical context is available in the GitHub Stored XSS Research writeup and the VulDB CVE-2026-94211 Detail entry.

No verified proof-of-concept code is republished here. See the linked research repository for payload details.

Detection Methods for CVE-2026-94211

Indicators of Compromise

Project status labels containing HTML tags such as <script>, <img, <svg, or onerror= attributes
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading a Leantime project dashboard
Unexpected privilege changes, role assignments, or ownership transfers on projects modified by non-owner editors

Detection Strategies

Query the Leantime database for status label records and flag entries containing angle brackets, javascript: URIs, or HTML event handler attributes
Enable and review web server access logs for POST requests to status label update endpoints followed by dashboard GET requests from other user sessions
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution triggered from /dashboard/show routes

Monitoring Recommendations

Monitor Leantime application logs for permission grants of EDIT to newly created or low-trust accounts
Alert on repeated modification of the same status label by a single user within a short interval, which can indicate payload iteration
Track browser error reports and CSP violation reports originating from authenticated Leantime sessions

How to Mitigate CVE-2026-94211

Immediate Actions Required

Audit all existing project status labels for HTML markup and remove any suspicious entries
Restrict the EDIT permission to trusted users until a patched release is deployed
Review project ownership and administrative role assignments made after the vulnerable version was in use
Rotate session tokens and API keys for any user who may have loaded a poisoned dashboard

Patch Information

At the time of publication no vendor patch has been referenced in the NVD entry. The disclosure notes the vendor was contacted but did not respond. Monitor the VulDB Vulnerability Details page and the Leantime project repository for a fixed release beyond version 3.9.8.

Workarounds

Place Leantime behind a Web Application Firewall (WAF) rule that blocks status label update requests containing HTML tags or JavaScript event handlers
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Temporarily downgrade non-essential accounts from EDIT to read-only roles on sensitive projects
Apply a local patch to /app/Domain/Dashboard/Templates/show.blade.php that replaces raw output of the status label with Blade's escaped {{ $label }} syntax

bash

# Example CSP header to reduce stored XSS impact until patched
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";