---
id: CVE-2026-66416
title: >-
  Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows
  unauthenticated attackers to perform state-changing actions on behalf of
  authenticated users by excluding the Laravel VerifyCsrfToken middleware from
  the glob…
summary: >-
  Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows
  unauthenticated attackers to perform state-changing actions on behalf of
  authenticated users by excluding the Laravel VerifyCsrfToken middleware from
  the glob…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-352
published: '2026-07-30'
updated: '2026-07-31'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66416'
references:
  - url: 'https://github.com/Leantime/leantime'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Leantime/leantime/pull/3659'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifycsrftoken-middleware
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00256
epssPercentile: 0.15447
ingestedAt: '2026-08-01T22:15:46.275Z'
vendor: Leantime
product: Leantime
affected:
  - Leantime <= 3.6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-31T23:03:51.136675Z'
---

## Overview

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.