CSRF in Leantime
CVE-2026-66416
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (5.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Leantime — versions 0
Weakness classification (CWE)
References
- Pull Request (issue-tracking, patch)
- GitHub Security Advisory (GHSA-x8vx-9g5w-w5rr) (vendor-advisory)
- Product Repository (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-66416?
- CVE-2026-66416 is a high-severity vulnerability in Leantime, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2026-07-30.
- How severe is CVE-2026-66416?
- High severity. CVSS v3 base score is 8.8 out of 10.