Key points
- CVE-2026-85990 affects Leantime versions prior to 3.10.0 with a CVSS score of 8.8.
- Any authenticated user, including those with readonly roles, can escalate privileges.
- The flaw allows unauthorized installation, enabling, disabling, and removal of plugins.
Leantime versions earlier than 3.10.0 contain a high-severity authorization bypass identified as CVE-2026-85990. The vendor has released version 3.10.0 to address the vulnerability. Security teams should verify their current version and apply the update immediately to prevent unauthorized administrative access and plugin manipulation.
In plain English
The flaw exists in Leantime’s JSON-RPC API dispatcher. It exposes public service methods without checking if the user has permission to call them. Specifically, the system fails to enforce authorization when a method lacks a specific permission attribute. This allows a low-privilege user to perform actions that should require administrative rights.
The background
According to the National Vulnerability Database, the issue stems from how PermissionEnforcer::enforce handles methods missing a RequiresPermission attribute. It silently allows the call instead of blocking it. This affects account creation and plugin management surfaces. The vulnerability is classified under CWE-269 and CWE-862 weaknesses.
What changes now
The fix in version 3.10.0 corrects the missing per-method authorization checks. Previously, calling leantime.rpc.api.api.createApiKeyWithProjects allowed users to set an attacker-chosen role. Now, the system properly validates privileges before executing these sensitive operations. Plugin management methods also require proper administrative roles.
Who needs to act first
Teams should prioritize updating systems exposed to the internet or accessible by external contractors. Before rolling out the update, create a full backup of the database and application files. Test the upgrade on a staging environment to ensure no custom configurations break. If immediate patching is impossible, restrict access to the API endpoints using a web application firewall. Monitor logs for unusual API calls.
What to do and how to stay safe: Leantime
- Check the installed Leantime version against the vendor's advisory to confirm exposure.
- Apply the update to version 3.10.0 on all affected servers as soon as possible.
- Review API logs for calls to createApiKeyWithProjects or plugin management methods.
- Restrict network access to the JSON-RPC endpoint until the patch is verified.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which roles can exploit this vulnerability?
Any authenticated user, including those with the lowest-privilege readonly role, can exploit this flaw to escalate privileges.
Is there a fix available?
Yes, the issue is fixed in Leantime version 3.10.0. Users should upgrade to this version or later.
What specific methods are affected?
The createApiKeyWithProjects method allows privilege escalation. Plugin methods installPlugin, enablePlugin, disablePlugin, and removePlugin are also exposed.
