Skip to content
Threat Feed
Subscribe

Product

Leantime (<= 3.4.4)

1 brief RSS
high advisory

CVE-2026-59712: Leantime JSON-RPC API Authorization Bypass Leads to Credential Disclosure

An authenticated user can exploit CVE-2026-59712, an authorization bypass vulnerability in Leantime's JSON-RPC API `Users::getUser` method, to retrieve sensitive user credential information including password hashes, TOTP secrets, and session tokens for any user, leading to account enumeration, offline password cracking, 2FA bypass, and session hijacking.

Leantime authorization-bypass credential-disclosure api-exploitation web-vulnerability cve
3t 1c 3i