CVE-2026-66416

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Leantime 3.6.2

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-66416

EUVD

EUVD-2026-51199

Affected Vendors & Products

Vendor	Product	Version / Range
leantime	leantime	3.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Leantime 3.6.2 has a cross-site request forgery (CSRF) vulnerability due to missing Laravel VerifyCsrfToken middleware in app/Http/Kernel.php. This allows unauthenticated attackers to trick authenticated users into submitting unauthorized requests via malicious pages or phishing emails.

Detection Guidance

To detect this CSRF vulnerability in Leantime 3.6.2, inspect the app/Http/Kernel.php file for missing Laravel VerifyCsrfToken middleware in the global middleware stack. Check for unauthorized POST, PUT, or DELETE requests in server logs that modify projects, settings, or permissions without user consent.

Impact Analysis

Attackers can perform unauthorized actions like creating or deleting projects, modifying settings, or changing permissions as any authenticated user. This could lead to data loss, unauthorized access, or system compromise without the victim's knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations and penalties.

Mitigation Strategies

Immediately update Leantime to a patched version if available. Ensure the Laravel VerifyCsrfToken middleware is included in the global middleware stack in app/Http/Kernel.php. Implement CSRF tokens in all forms and validate requests server-side. Monitor for suspicious activity in logs.

Hi! I’m here to help you understand CVE-2026-66416. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70