---
id: CVE-2026-76647
title: >-
  Leantime JSON-RPC API through version 3.9.0 contains a missing authorization
  vulnerability in the JSON-RPC dispatcher in
  app/Domain/Api/Controllers/Jsonrpc.php
summary: >-
  Leantime JSON-RPC API through version 3.9.0 contains a missing authorization
  vulnerability in the JSON-RPC dispatcher in
  app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce
  authorization before invoking service-layer …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-200
  - CWE-639
  - CWE-862
published: '2026-08-19'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:07:24.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76647'
references:
  - url: 'https://leantime.io/unlocking-leantimes-power-a-guide-to-the-json-rpc-api/'
    label: cret@cert.org
  - url: 'https://vokecyber.com/blog/leantime-jsonrpc-editown-account-takeover'
    label: cret@cert.org
  - url: 'https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover'
    label: cret@cert.org
  - url: 'https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00375
epssPercentile: 0.3138
ingestedAt: '2026-09-08T15:33:26.954Z'
---

## Overview

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user's account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.