Description
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Leantime Leantime
Default version status: affected
0 to ≤ 3.6.2affected
References
- https://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6 ↗
- https://github.com/Leantime/leantime/pull/3657 ↗
- https://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae ↗
- https://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc ↗