PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54418 Leantime CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T08:16:33.777Z and has not been modified since then. Leantime 3.6.2 is affected by a vulnerability in its JSON-RPC methods, specifically leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA. These methods act on a caller-supplied userId parameter without ownership checks, session pinning, or permission-attribute gates. Authenticated users can invoke getSetupData to read live TOTP secrets or disable2FA to strip 2FA from other accounts, fully defeating account-level 2FA protection. This vulnerability allows for the bypass of account-level 2FA protection, potentially leading to unauthorized access. The CVE details indicate that this issue is related to CVE-2026-15509, which covers a similar missing-authorization pattern in the JSON-RPC editUser/addUser role-assignment path in the same application; however, the TwoFA service methods addressed here are a distinct, independently fixable set of RPC endpoints. Evidence is limited to CVE details and NVD information. Defenders should verify Leantime installations, review JSON-RPC endpoint access, and monitor for suspicious activity.

Vendor
Leantime
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

Users of Leantime 3.6.2, administrators of Leantime installations, security teams monitoring for 2FA bypass vulnerabilities, and operators of systems relying on 2FA for authentication should be aware of this vulnerability. They should assess their exposure, apply mitigations, and monitor for suspicious activity related to JSON-RPC endpoints in Leantime deployments. Vulnerability management and security teams should prioritize patching or mitigating this vulnerability to prevent potential 2FA bypass attacks.

Technical summary

Leantime 3.6.2 exposes JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter without ownership checks, session pinning, or permission-attribute gates. Authenticated users can invoke getSetupData to read live TOTP secrets or disable2FA to strip 2FA from other accounts. This vulnerability allows for the bypass of account-level 2FA protection, potentially leading to unauthorized access.

Defensive priority

Authenticated users can invoke JSON-RPC methods to read or disable 2FA for arbitrary users, fully defeating account-level 2FA protection.

Recommended defensive actions

  • Inventory and verify Leantime installations for version 3.6.2
  • Restrict access to JSON-RPC endpoints
  • Implement ownership checks and session pinning for userId parameters
  • Monitor for suspicious activity on JSON-RPC endpoints
  • Consider compensating controls for 2FA protection

Evidence notes

The CVE description indicates Leantime 3.6.2 exposes JSON-RPC methods acting on a caller-supplied userId parameter without ownership checks, session pinning, or permission-attribute gates. Authenticated users can invoke getSetupData to read live TOTP secrets or disable2FA to strip 2FA from other accounts. Evidence is limited to CVE details and NVD information. Defenders should verify Leantime installations, review JSON-RPC endpoint access, and monitor for suspicious activity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T08:16:33.777Z and has not been modified since then.