Improper Authorization in Leantime via JSON-RPC Endpoint

Publication date: 2026-07-12

Last updated on: 2026-07-12

Assigner: VulDB

Description

A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-12

Last Modified

2026-07-12

Generated

2026-07-13

AI Q&A

2026-07-13

EPSS Evaluated

N/A

NVD

CVE-2026-15509

Affected Vendors & Products

Vendor	Product	Version / Range
leantime	leantime	to 3.8.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Leantime versions up to 3.8.0, specifically affecting the editUser and addUser functions of the JSON-RPC Endpoint component. It involves improper authorization caused by manipulation of the 'role' argument. An attacker can exploit this remotely to potentially gain unauthorized access or privileges.

Impact Analysis

The vulnerability allows an attacker to manipulate user roles without proper authorization, which can lead to unauthorized access or privilege escalation. This could compromise the integrity and security of the affected system, potentially allowing attackers to perform actions they should not be permitted to do.

Hi! I’m here to help you understand CVE-2026-15509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70