Packagist/leantime/leantime CVE-2026-85990: high 8.8

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Action: Upgrade leantime/leantime to 3.10.0 or later.

composer require leantime/leantime:3.10.0

Affected

Fixed versions

Sources

• osv: GHSA-54mm-6729-r5wp
• https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp
• https://nvd.nist.gov/vuln/detail/CVE-2026-85990
• https://github.com/Leantime/leantime/pull/3583
• https://github.com/Leantime/leantime/pull/3797
• https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02
• https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e
• https://github.com/Leantime/leantime
• https://github.com/Leantime/leantime/releases/tag/v3.10.0

CVE-2026-85990 · published 2026-10-15T20:14:43Z · modified 2026-10-15T20:30:06.074137323Z · JSON