CVE-2026-66412
Received Received - Intake

Broken Access Control in Leantime Exposes Project Milestones

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66412
EUVD
EUVD-2026-49063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
leantime leantime to 3.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66412 is a broken access control vulnerability in Leantime versions 3.6.2 and prior. It allows authenticated users to read milestone data from projects they are not assigned to by providing arbitrary milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate milestone IDs to access sensitive project planning details across all projects on the instance.

Detection Guidance

To detect this vulnerability, check if your Leantime instance allows unauthorized access to milestone data via the tickets.getMilestone JSON-RPC endpoint. Test by sending authenticated requests with arbitrary milestone IDs and verify if non-assigned project milestones are returned. Monitor logs for repeated failed access attempts or unusual milestone ID enumeration patterns.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive project information such as milestone titles, descriptions, and timelines. Attackers with valid credentials can exploit it to gather confidential planning data from projects they should not have access to, potentially causing data leaks or competitive disadvantages.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA by allowing unauthorized access to sensitive project data. GDPR requires protecting personal data, while HIPAA mandates securing health-related information. Unauthorized access could lead to regulatory penalties, legal liabilities, and reputational damage.

Mitigation Strategies

Immediately update Leantime to a version that includes the fix for CVE-2026-66412. If updating is not possible, restrict access to the tickets.getMilestone endpoint by implementing project ownership checks similar to the getTicket method. Review and audit user permissions to ensure proper access controls are in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66412. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart