Vulnerability · Published Jul 27, 2026 · Assigned by VulnCheck

CVE-2026-66412Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in Leantime from Leantime. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

Affected products (as reported)

Vendor	Product	Versions
Leantime	Leantime	0 – through 3.6.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory vendor-advisory
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc third-party-advisory