{"id":"CVE-2026-15509","state":"PUBLISHED","title":"Leantime JSON-RPC Endpoint addUser improper authorization","description":"A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-07-12T22:30:09.041Z","updatedAt":"2026-07-15T15:36:02.287Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["n/a Leantime"],"affected":[{"vendor":"n/a","product":"Leantime","versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"},{"version":"3.6","status":"affected"},{"version":"3.7","status":"affected"},{"version":"3.8.0","status":"affected"}],"cpes":["cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"],"modules":["JSON-RPC Endpoint"]}],"references":["https://vuldb.com/vuln/377838","https://vuldb.com/vuln/377838/cti","https://vuldb.com/cve/CVE-2026-15509","https://vuldb.com/submit/846167","https://bytium.com/insights/leantime-priv-escalation-vulnerability-low-priv-to-owner"],"weaknesses":["CWE-285","CWE-266"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15509.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15509","state":"PUBLISHED","datePublished":"2026-07-12T22:30:09.041Z","dateUpdated":"2026-07-15T15:36:02.287Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-07-12T05:58:31.153Z"},"containers":{"cna":{"title":"Leantime JSON-RPC Endpoint addUser improper authorization","descriptions":[{"lang":"en","value":"A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"n/a","product":"Leantime","versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5","status":"affected"},{"version":"3.6","status":"affected"},{"version":"3.7","status":"affected"},{"version":"3.8.0","status":"affected"}],"cpes":["cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*"],"modules":["JSON-RPC Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/377838","name":"VDB-377838 | Leantime JSON-RPC Endpoint addUser improper authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/377838/cti","name":"VDB-377838 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-15509","name":"CVE-2026-15509 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/846167","name":"Submit #846167 | Leantime Leantime project management system 3.8.0 Privilege Escalation / Improper Authorization","tags":["third-party-advisory"]},{"url":"https://bytium.com/insights/leantime-priv-escalation-vulnerability-low-priv-to-owner","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-07-14T15:23:43.559Z"},"timeline":[{"time":"2026-07-12T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-07-12T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-07-14T17:25:41.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Jobyer Ahmed (Bytium)","type":"finder"},{"lang":"en","value":"suffer (VulDB User)","type":"reporter"},{"lang":"en","value":"suffer (VulDB User)","type":"analyst"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/submit/846167","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-15T15:35:51.218638Z","id":"CVE-2026-15509","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-15T15:36:02.287Z"}}]}}}