CVE-2026-59712: Leantime - JSON-RPC API Broken Access Control via users.getUser

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-10-25
Weakness: CWE-639

Description

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

Affected products

Leantime: through 3.4.4

References

https://github.com/Leantime/leantime
https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671
https://github.com/Leantime/leantime/issues/3556
https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method

Get alerted when CVE-2026-59712 or the next vulnerability affects your stack