{"id":"CVE-2026-66412","title":"Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC","summary":"Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMileston…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Leantime","product":"Leantime","affected":["Leantime <= 3.6.2"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-27T18:05:16.983179Z"},"exploitAvailable":true,"published":"2026-07-27","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:18:20.940Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-66412","references":[{"url":"https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6","label":"GitHub Security Advisory"},{"url":"https://github.com/Leantime/leantime/pull/3657","label":"Pull Request"},{"url":"https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc"}],"tags":["cve.org","exploit-available"],"epss":0.00313,"epssPercentile":0.24481,"ingestedAt":"2026-09-24T15:45:56.720Z","slug":"CVE-2026-66412","body":"## Overview\n\nLeantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.\n\n## Affected\n\n- `Leantime <= 3.6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}