Skip to content
Heist/ feed
Back to feed
High

Leantime - JSON-RPC API Broken Access Control via users.getUser

Type: advisorySources: OSV

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-59712
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 23:59 UTC · Revision 1

Source evidence

Leantime - JSON-RPC API Broken Access Control via users.getUser

core-osv · Original source

Published 6 Jul 2026, 20:43 UTC

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

osv:CVE-2026-59712
Complete source record
{
  "id": "1d8519df086707bc0a91983ce6311a7eab81ab51030f945ad854e2fea4545270",
  "url": "https://osv.dev/vulnerability/CVE-2026-59712",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Leantime - JSON-RPC API Broken Access Control via users.getUser",
    "summary": "Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.",
    "evidence": "osv:CVE-2026-59712",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-59712",
      "aliases": [
        "CVE-2026-59712"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/leantime/leantime",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4f2612d13e0e8a2093092a846b44506cf133b671"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.4.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4f2612d13e0e8a2093092a846b44506cf133b671"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.9.5",
            "v3.9.4",
            "v3.9.3",
            "v3.9.2",
            "v3.9.1",
            "v3.9.0",
            "v3.8.0",
            "v3.7.3",
            "v3.7.2",
            "v3.7.1",
            "v3.7.0",
            "v3.6.2",
            "latest",
            "v3.6.1",
            "v3.6.0",
            "v3.5.12",
            "v3.5.11",
            "v3.5.10",
            "v3.5.8",
            "v3.5.7",
            "v3.5.6",
            "v3.5.5",
            "v3.5.4",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.4.12",
            "v3.4.11",
            "v3.4.10",
            "v3.4.9",
            "v3.4.7",
            "v3.4.6",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.3",
            "v3.3.1",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.2.0-beta-2",
            "v3.2.0-beta",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0-beta",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5",
            "v3.0.4",
            "v3.0.3",
            "v3.0.1",
            "v3.0.2",
            "v3.0.0",
            "v3.0.0-beta",
            "v2.4.8",
            "v2.4.7",
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4-beta-8",
            "v2.4",
            "v2.4-beta-7",
            "v2.4-beta",
            "v2.3.27",
            "v2.3.26",
            "v2.3.24",
            "v2.3.25",
            "v2.3.23",
            "v2.3.22",
            "v2.3.21",
            "v2.3.20",
            "v2.3.19",
            "v2.3.18",
            "v2.3.17",
            "v2.3.16",
            "v2.3.15",
            "v2.3.14",
            "v2.3.13",
            "v2.3.12",
            "v2.3.11",
            "v2.3.10",
            "v2.3.9",
            "v2.3.8",
            "v2.3.7",
            "v2.3.6",
            "v2.3.5",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1-beta",
            "v2.3.0-beta",
            "v2.3-beta",
            "v2.2.11",
            "v2.2.10",
            "v2.2.9",
            "v2.2.8",
            "v2.2.7",
            "v2.2.6",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.0",
            "v2.2.2",
            "v2.2.1",
            "v2.1.9",
            "v2.1.8",
            "v2.1.7",
            "v2.1.6",
            "v2.1.5",
            "v2.1.4",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1",
            "v2.1-beta6",
            "v2.1-beta5",
            "v2.1-beta4b",
            "v2.1-beta3",
            "v2.0.14",
            "v2.1-beta2",
            "v2.1-beta",
            "v2.0.13",
            "v2.0.12",
            "v2.0.11",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0",
            "v0.9.5-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59712.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:40.426764775Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59712.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-59712",
        "https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthenticated-json-rpc-users-getuser-method",
        "https://github.com/Leantime/leantime/issues/3556",
        "https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133b671",
        "https://github.com/Leantime/leantime"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59712.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-59712",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 508191,
  "published_at": "2026-07-06T20:43:50.296+00:00"
}