Leantime JSON-RPC Endpoint addUser improper authorization
Summary
| CVE | CVE-2026-15509 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-12 23:16:37 UTC |
| Updated | 2026-07-15 16:16:43 UTC |
| Description | A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
Risk And Classification
Primary CVSS: v4.0 2.1 LOW from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003330000 probability, percentile 0.254410000 (date 2026-07-19)
Problem Types: CWE-266 | CWE-285 | CWE-285 Improper Authorization | CWE-266 Incorrect Privilege Assignment
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.1 | LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | DECLARED | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| 3.1 | [email protected] | Secondary | 6.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| 3.1 | CNA | DECLARED | 6.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 3.0 | CNA | DECLARED | 6.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 2.0 | [email protected] | Secondary | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | |
| 2.0 | CNA | DECLARED | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v3.0 Breakdown
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Leantime | affected 3.0 | Not specified |
| CNA | Na | Leantime | affected 3.1 | Not specified |
| CNA | Na | Leantime | affected 3.2 | Not specified |
| CNA | Na | Leantime | affected 3.3 | Not specified |
| CNA | Na | Leantime | affected 3.4 | Not specified |
| CNA | Na | Leantime | affected 3.5 | Not specified |
| CNA | Na | Leantime | affected 3.6 | Not specified |
| CNA | Na | Leantime | affected 3.7 | Not specified |
| CNA | Na | Leantime | affected 3.8.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/cve/CVE-2026-15509 | [email protected] | vuldb.com | |
| bytium.com/insights/leantime-priv-escalation-vulnerability-low-priv-to-o... | [email protected] | bytium.com | |
| vuldb.com/submit/846167 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | vuldb.com | |
| vuldb.com/vuln/377838/cti | [email protected] | vuldb.com | |
| vuldb.com/vuln/377838 | [email protected] | vuldb.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jobyer Ahmed (Bytium) (en)
CNA: suffer (VulDB User) (en)
CNA: suffer (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-12T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-07-12T02:00:00.000Z | VulDB entry created |
| CNA | 2026-07-14T17:25:41.000Z | VulDB entry last update |