High
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
Type: advisorySources: OSV
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-66416
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 14:13 UTC · Revision 1
Source evidence
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
core-osv · Original sourcePublished 30 Jul 2026, 17:00 UTC
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
osv:CVE-2026-66416
Complete source record
{
"id": "ced26da6443e706c8d85ce4b50854fa1760291c6e2a6e32353deb3626ce17c41",
"url": "https://osv.dev/vulnerability/CVE-2026-66416",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware",
"summary": "Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.",
"evidence": "osv:CVE-2026-66416",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-66416",
"aliases": [
"CVE-2026-66416",
"GHSA-x8vx-9g5w-w5rr"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/leantime/leantime",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "d6c4672e23380c70d02649c60576a71f60f69b5c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.6.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"v3.6.2",
"latest",
"v3.6.1",
"v3.6.0",
"v3.5.12",
"v3.5.11",
"v3.5.10",
"v3.5.8",
"v3.5.7",
"v3.5.6",
"v3.5.5",
"v3.5.4",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"v3.4.12",
"v3.4.11",
"v3.4.10",
"v3.4.9",
"v3.4.7",
"v3.4.6",
"v3.4.5",
"v3.4.4",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.3",
"v3.3.1",
"v3.3.0",
"v3.2.1",
"v3.2.0",
"v3.2.0-beta-2",
"v3.2.0-beta",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0-beta",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.1",
"v3.0.2",
"v3.0.0",
"v3.0.0-beta",
"v2.4.8",
"v2.4.7",
"v2.4.5",
"v2.4.4",
"v2.4.3",
"v2.4.2",
"v2.4.1",
"v2.4-beta-8",
"v2.4",
"v2.4-beta-7",
"v2.4-beta",
"v2.3.27",
"v2.3.26",
"v2.3.24",
"v2.3.25",
"v2.3.23",
"v2.3.22",
"v2.3.21",
"v2.3.20",
"v2.3.19",
"v2.3.18",
"v2.3.17",
"v2.3.16",
"v2.3.15",
"v2.3.14",
"v2.3.13",
"v2.3.12",
"v2.3.11",
"v2.3.10",
"v2.3.9",
"v2.3.8",
"v2.3.7",
"v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1-beta",
"v2.3.0-beta",
"v2.3-beta",
"v2.2.11",
"v2.2.10",
"v2.2.9",
"v2.2.8",
"v2.2.7",
"v2.2.6",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"v2.2.0",
"v2.2.2",
"v2.2.1",
"v2.1.9",
"v2.1.8",
"v2.1.7",
"v2.1.6",
"v2.1.5",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1",
"v2.1-beta6",
"v2.1-beta5",
"v2.1-beta4b",
"v2.1-beta3",
"v2.0.14",
"v2.1-beta2",
"v2.1-beta",
"v2.0.13",
"v2.0.12",
"v2.0.11",
"v2.0.10",
"v2.0.9",
"v2.0.8",
"v2.0.7",
"v2.0.6",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0",
"v0.9.5-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66416.json"
}
}
],
"modified": "2026-10-28T02:30:29.385760382Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66416.json",
"https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr",
"https://nvd.nist.gov/vuln/detail/CVE-2026-66416",
"https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware",
"https://github.com/Leantime/leantime/pull/3659",
"https://github.com/Leantime/leantime"
],
"provider_metadata": {
"cwe_ids": [
"CWE-352"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66416.json"
}
},
"related_cves": [
{
"value": "CVE-2026-66416",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496249,
"published_at": "2026-07-30T17:00:10.215+00:00"
}