Missing Authorization in Leantime JSON-RPC API

Executive Summary

CVE-2026-76647 is a missing authorization vulnerability in Leantime's JSON-RPC API (versions 3.x through 3.8.0). The JSON-RPC dispatcher does not enforce authorization checks before invoking methods like editOwn. This allows an authenticated user to supply an arbitrary user ID and reset another user's password, including the administrator's, leading to full account takeover. The flaw stems from the JSON-RPC endpoint bypassing session-based user ID restrictions present in the web interface.

The vulnerability is an Insecure Direct Object Reference (IDOR) combined with missing authorization (CWE-639 and CWE-862). It requires only a valid session cookie and no victim interaction. The issue was fixed in Leantime v3.9.0 by enforcing session-based authorization in the JSON-RPC dispatcher.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for JSON-RPC API requests targeting the /api/jsonrpc endpoint. Look for requests containing the editOwn method with a user-supplied user ID parameter. Check Leantime versions prior to 3.9.0, as the flaw exists in 3.x through 3.8.0. Monitor for unauthorized password reset attempts or account modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with any valid Leantime account (even low-privilege) can exploit this to reset passwords of any user, including administrators, and take over their accounts. This grants full access to projects, client data, files, timesheets, and settings. The attacker can also lock legitimate users out by changing their email and password. The impact is severe as it allows complete control over the Leantime instance with minimal effort.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (Article 32 for security of processing) and HIPAA (Access Control standard). It enables unauthorized access to sensitive project management data, potentially leading to data breaches. Organizations using affected Leantime versions may face regulatory penalties, reputational damage, and loss of customer trust due to inadequate access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Leantime to version 3.9.0 or later immediately. If upgrading is not possible, restrict access to the JSON-RPC API endpoint (/api/jsonrpc) via firewall rules or disable the API entirely. Review all user accounts for unauthorized changes and reset passwords for potentially affected accounts.

Useful 0 Not Useful 0