{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/json-rpc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Leantime"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","json-rpc","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Leantime"],"content_html":"\u003cp\u003eLeantime contains a critical authorization vulnerability where multiple JSON-RPC service methods are exposed without necessary role-based access control. The application utilizes a \u003ccode\u003ePermissionEnforcer\u003c/code\u003e class that relies on a \u003ccode\u003e#[RequiresPermission]\u003c/code\u003e PHP attribute to gate access; however, when this attribute is missing, the enforcer fails open, permitting any authenticated user to execute the method. This affects sensitive administrative functions, specifically \u003ccode\u003eleantime.rpc.api.api.createApiKeyWithProjects\u003c/code\u003e, which allows an attacker to create new accounts with arbitrary roles, and plugin management methods like \u003ccode\u003einstallPlugin\u003c/code\u003e and \u003ccode\u003eenablePlugin\u003c/code\u003e. Because the application's first-party JavaScript client uses \u003ccode\u003eX-Requested-With: XMLHttpRequest\u003c/code\u003e headers to authenticate via session cookies, an attacker can leverage their existing, low-privilege session to trigger these methods directly via the JSON-RPC endpoint.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a Leantime instance with a low-privileged account (e.g., 'readonly' role).\u003c/li\u003e\n\u003cli\u003eAttacker verifies the current session is active by capturing the session cookie from the browser or application traffic.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON-RPC POST request targeting the \u003ccode\u003e/api/jsonrpc\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker includes the required \u003ccode\u003eX-Requested-With: XMLHttpRequest\u003c/code\u003e header to ensure the session middleware processes the authenticated request.\u003c/li\u003e\n\u003cli\u003eAttacker calls the \u003ccode\u003eleantime.rpc.api.api.createApiKeyWithProjects\u003c/code\u003e method, supplying a JSON payload with \u003ccode\u003erole\u003c/code\u003e set to 40 (Admin).\u003c/li\u003e\n\u003cli\u003eThe backend processes the request without checking the caller's privileges, creating a new administrative user.\u003c/li\u003e\n\u003cli\u003eAttacker receives the new credentials (username/password) in the JSON-RPC response body.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the application using the escalated credentials to gain full administrative access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to achieve full administrative control over the Leantime instance. By creating administrative accounts or manipulating plugins, an attacker can perform unauthorized data access, system configuration changes, and potentially achieve remote code execution through the installation of malicious plugins. This affects all Leantime instances that have not yet applied the vendor's security update.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Leantime immediately to the patched version provided by the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor HTTP traffic for POST requests to \u003ccode\u003e/api/jsonrpc\u003c/code\u003e that originate from low-privilege users or IP addresses not associated with authorized administrative workstations.\u003c/li\u003e\n\u003cli\u003eEnable web application firewall (WAF) rules to inspect and validate JSON-RPC method calls against a known-good allowlist of permitted administrative methods.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts for suspicious additions or modifications to user roles, specifically looking for accounts created via automated API workflows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:24:38Z","date_published":"2026-10-15T22:24:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-leantime-auth-bypass/","summary":"Authenticated users can escalate privileges to administrator or manage plugins by invoking unauthorized JSON-RPC methods in Leantime.","title":"Leantime JSON-RPC Privilege Escalation","url":"https://feed.craftedsignal.io/briefs/2026-10-leantime-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Json-Rpc","version":"https://jsonfeed.org/version/1.1"}