CVE-2026-59712: Leantime JSON-RPC API Authorization Bypass Leads to Credential Disclosure

CVE-2026-59712 describes a critical authorization bypass vulnerability in Leantime, an open-source project management system. The flaw exists within the Users::getUser method of its JSON-RPC API, where proper authorization checks are missing. This allows any authenticated user, regardless of their privilege level, to retrieve full user credential rows for any other user by simply providing arbitrary user IDs in the API call. This vulnerability was published to NVD on July 6, 2026, and impacts Leantime versions up to and including 3.4.4. Attackers can leverage this to enumerate all accounts on a compromised system, obtain sensitive data like password hashes, Time-based One-Time Password (TOTP) secrets, and session tokens, ultimately enabling sophisticated attacks such as offline password cracking, two-factor authentication bypass, and session hijacking. The exploitation of this vulnerability could lead to widespread unauthorized access and data exfiltration within an organization using Leantime.

Attack Chain

1. An attacker obtains initial access to the Leantime application through a low-privileged authenticated user account.
2. The attacker authenticates to the Leantime application using the compromised or created low-privileged credentials.
3. The attacker identifies the JSON-RPC API endpoint for user management.
4. The attacker crafts malicious JSON-RPC requests targeting the users.getUser method, specifying arbitrary user_id values.
5. Due to the authorization bypass (CVE-2026-59712), the API responds with full user credential rows, including password hashes, TOTP secrets, and session tokens, for the requested user IDs.
6. The attacker iteratively sends requests with different user_id values to enumerate and collect sensitive information for multiple or all users within the Leantime instance.
7. The collected password hashes are then subjected to offline password cracking attempts to recover plaintext passwords.
8. Recovered passwords, TOTP secrets, and session tokens enable the attacker to bypass multi-factor authentication, hijack active user sessions, and gain unauthorized access to other user accounts, potentially escalating privileges.

Impact

The successful exploitation of CVE-2026-59712 leads to complete compromise of user accounts within the affected Leantime instance. Attackers can gain unauthorized access to all projects, tasks, and sensitive data managed within the application, including those belonging to high-privileged users like administrators. The disclosure of password hashes, TOTP secrets, and session tokens provides avenues for persistent access, privilege escalation, and bypass of standard security controls such as two-factor authentication. This can result in significant data exfiltration, intellectual property theft, and broader organizational compromise if Leantime manages critical business processes or sensitive information. The specific number of victims will vary per affected organization, but all user accounts within a vulnerable instance are at risk of compromise.

Recommendation

• Patch CVE-2026-59712 immediately by updating Leantime to a patched version beyond 3.4.4. Refer to the official Leantime GitHub repository for security updates and recommended mitigation steps.
• Monitor webserver logs for unusual HTTP POST requests to Leantime's JSON-RPC API endpoints, especially those targeting the users.getUser method with multiple or iterative user_id parameters from a single source IP or authenticated session.
• Implement network segmentation to restrict access to the Leantime application from untrusted networks and ensure the JSON-RPC API is not directly exposed to the internet if not strictly necessary.
• Rotate all user credentials and sessions for your Leantime instance after applying the patch, as existing credentials and session tokens might have been compromised.