CVE-2026-94210
Deferred Deferred - Pending Action

Cross-Site Scripting in Leantime Kanban Board

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94210
EUVD
EUVD-2026-83890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hyve5 leantime to 3.9.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94210 is a stored cross-site scripting (XSS) vulnerability in Leantime, an open-source project management system. It allows authenticated users to inject malicious JavaScript into their profile name, which executes when viewed by higher-privileged users in the Kanban board's swimlane headers. The attack can escalate privileges to owner/admin status.

Detection Guidance

Check Leantime instances for versions 3.9.8 or earlier. Inspect user profile names for suspicious JavaScript payloads in firstname/lastname fields. Review Kanban board swimlane headers for unescaped HTML rendering. Monitor for unauthorized privilege escalations or new admin accounts created by low-privileged users.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate project management functions, or escalate privileges to admin/owner level. This could lead to data theft, unauthorized changes, or system compromise if exploited.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through XSS attacks or HIPAA by allowing unauthorized access to sensitive health information. Organizations may face compliance penalties due to inadequate data protection measures.

Mitigation Strategies

Apply the patch a30a6837b4071ac05a4f58d0e1baa2c62aa8695e immediately. Ensure all user-controlled inputs in profile names and group labels are HTML-encoded. Restrict user creation endpoints to prevent unauthorized privilege escalation. Re-enable CSRF protection on user creation endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart