CVE-2026-54418: Leantime

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

Affected products

• Leantime Leantime: up to and including 3.6.2

Published 2026-08-05. Last modified 2026-08-28.