Vulnerability · Published Jul 6, 2026 · Assigned by VulnCheck

CVE-2026-59712Leantime - JSON-RPC API Broken Access Control via users.getUser

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in Leantime from Leantime. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

Affected products (as reported)

Vendor	Product	Versions
Leantime	Leantime	0 – through 3.4.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue issue-tracking
Product product
Patch Commit patch
https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method third-party-advisory