CVE-2026-85990 Leantime CVE debrief

Who should care

Defenders responsible for Leantime instances, security teams, and administrators should assess exposure and apply remediation. They should prioritize verifying exposure, assessing inventory, and applying remediation to affected Leantime instances. Additionally, they should review compensating controls for exposed systems and monitor for suspicious activity.

Why it matters

CVE-2026-85990 allows authenticated users to escalate privileges to admin, potentially leading to unauthorized access and data breaches.

• Privilege escalation to admin privileges
• Unauthorized access to sensitive data
• Potential for lateral movement within the network
• Need for verification of affected versions and remediation

Technical summary

The vulnerability is caused by missing per-method authorization on JSON-RPC-exposed service methods in Leantime's JSON-RPC API. Leantime's JSON-RPC API reflects any public method on any @api-annotated service class and dispatches it at leantime.rpc.{domain}.{service}.{method}. Per-method authorization is enforced by PermissionEnforcer::enforce() which reads a #[RequiresPermission(...)] PHP attribute off the target method. However, when the attribute is missing, the methods are callable by any authenticated user, leading to potential privilege escalation.

Defensive priority

Defenders should prioritize verifying exposure, assessing inventory, and applying remediation to affected Leantime instances.

Recommended defensive actions

• Verify Leantime instance exposure and inventory
• Assess user roles and access controls
• Apply remediation to affected instances
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The vulnerability allows authenticated users to escalate privileges by calling specific JSON-RPC methods without proper authorization checks. The server creates a new account at the chosen role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause also leaves the Plugins service's installPlugin, enablePlugin, disablePlugin, and removePlugin methods callable by any authenticated user with no role check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.