Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
leantime:leantime
References 4
https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795b…
disclosure@vulncheck.com
https://github.com/Leantime/leantime/pull/3657
disclosure@vulncheck.com
https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-…
disclosure@vulncheck.com