---
id: CVE-2026-66412
title: >-
  Leantime all versions prior to and 3.6.2 Broken Access Control via
  tickets.getMilestone JSON-RPC
summary: >-
  Leantime 3.6.2 and prior contains a broken access control vulnerability that
  allows authenticated users to read milestone data from projects they are not
  assigned to by supplying arbitrary integer milestone IDs to the
  tickets.getMileston…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Leantime
product: Leantime
affected:
  - Leantime <= 3.6.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-27T18:05:16.983179Z'
exploitAvailable: true
published: '2026-07-27'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:20.940Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-66412'
references:
  - url: >-
      https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
    label: GitHub Security Advisory
  - url: 'https://github.com/Leantime/leantime/pull/3657'
    label: Pull Request
  - url: >-
      https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc
tags:
  - cve.org
  - exploit-available
epss: 0.00415
epssPercentile: 0.33143
ingestedAt: '2026-09-24T15:45:56.720Z'
---

## Overview

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

## Affected

- `Leantime <= 3.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.