Threat Intelligence Report — CVE-2026-76647

Executive Summary

CVE-2026-76647 is a critical missing authorization vulnerability in the Leantime JSON-RPC API, affecting all versions through 3.9.0. The JSON-RPC dispatcher fails to enforce centralized authorization before invoking service-layer methods, allowing any authenticated user to call methods or act on resources outside their intended permission scope. Successful exploitation enables an attacker to modify another user's account and set a new password, resulting in full account takeover. No patch is currently available from the vendor, and the vulnerability is confirmed as distinct from CVE-2026-59712 and CVE-2026-15509 due to its root cause being the absence of centralized authorization enforcement in the dispatcher itself rather than flaws in individual exposed methods.

Technical Analysis

The vulnerability resides in the JSON-RPC dispatcher located at app/Domain/Api/Controllers/Jsonrpc.php in Leantime versions through 3.9.0. The core flaw is a missing authorization check at the dispatcher level — the component responsible for routing incoming JSON-RPC requests to the appropriate service-layer methods does not validate whether the authenticated caller possesses the necessary permissions to invoke a given method or access a particular resource.

The JSON-RPC architecture in Leantime exposes a set of remote procedure call endpoints that map to backend service-layer methods. In a properly designed system, the dispatcher acts as a central chokepoint where authorization policies are enforced uniformly across all exposed methods. This design ensures that even if an individual method lacks its own authorization logic, the dispatcher prevents unauthorized access. In this vulnerable implementation, the dispatcher forwards requests to service-layer methods without any permission verification, effectively delegating all security enforcement to the individual methods themselves — many of which were not designed to perform their own authorization checks.

The NVD description provides a concrete example of the impact: the editOwn method accepts a user-supplied user ID parameter without verifying that this ID corresponds to the authenticated caller. An attacker can pass the victim's user ID as a parameter, and because the dispatcher does not enforce that a user may only modify their own account, the method executes with the victim's identity context. The attacker can then set a new password for the victim's account, achieving complete account takeover.

The distinction from related CVEs is significant. CVE-2026-59712 and CVE-2026-15509 are attributed to defects in individual exposed methods' behavior. CVE-2026-76647, however, identifies the architectural root cause: the absence of centralized authorization enforcement in the JSON-RPC dispatcher. This means that even if individual methods were hardened, the underlying architectural weakness would remain until the dispatcher is fixed to enforce authorization uniformly.

The attack surface is substantial because the JSON-RPC API is a public-facing interface designed to be accessible to authenticated users across the application. Every method exposed through this dispatcher is potentially vulnerable to unauthorized invocation, not just editOwn. The blast radius extends to any operation accessible via JSON-RPC, including but not limited to user management, project modifications, task updates, and other administrative functions.

Exploitation Scenarios

The attack chain for CVE-2026-76647 proceeds as follows (inferred from vulnerability class; no public PoC available):

Step 1 — Reconnaissance and Target Identification: An attacker first identifies a Leantime instance running version 3.9.0 or earlier. Shodan dorks such as http.title:"Leantime" or product:"Leantime" can locate exposed instances. The attacker requires valid credentials for any account on the system — even a low-privileged user account suffices. Credentials may be obtained via phishing, credential stuffing, previous breaches, or legitimate registration if self-signup is enabled. The attacker also identifies the target victim account to compromise (e.g., an administrator or a user with elevated privileges).

Step 2 — Triggering the Flaw: The attacker authenticates to the Leantime instance and gains a session token or API key. They then craft a JSON-RPC request targeting the vulnerable dispatcher endpoint (app/Domain/Api/Controllers/Jsonrpc.php). The key aspect of the attack is that the dispatcher forwards the request to service-layer methods without any authorization validation.

Step 3 — Execution Method: The attacker constructs a JSON-RPC call that invokes the editOwn method (or any other exposed method that accepts a user ID parameter) and supplies the victim's user ID as an argument. Because the dispatcher does not verify that the requested user ID belongs to the authenticated caller, the method executes in the context of the victim's account. The attacker includes a new password in the request payload, effectively resetting the victim's password. The request is structurally identical to a legitimate account-editing operation, differing only in the target user ID — making it difficult to distinguish from normal API traffic at the network level.

Step 4 — Post-Exploitation Impact: Once the password is changed, the attacker logs into the victim's account using the newly set password. If the victim is an administrator, the attacker gains full administrative control over the Leantime instance, including access to all projects, tasks, files, client data, and user information. The attacker may also pivot to further attacks — modifying project timelines, exfiltrating sensitive business data, creating backdoor administrative accounts, or using the compromised instance as a foothold for lateral movement into the broader corporate network if Leantime is self-hosted on internal infrastructure. The account takeover may go undetected if the legitimate user does not immediately notice the password change.

No public proof-of-concept, Nuclei template, or exploit code has been observed to date. However, the vulnerability class (IDOR combined with missing authorization) is well-understood and trivially exploitable by any attacker with moderate API knowledge. The attack chain is straightforward and does not require specialized tooling beyond standard HTTP clients or curl.

Impact Assessment

Business Impact: CVE-2026-76647 represents a critical risk to organizations using Leantime for project management and team collaboration. The vulnerability enables account takeover of any user, with particular severity when administrative accounts are targeted. Because the flaw allows an authenticated user to invoke any service-layer method via the JSON-RPC dispatcher, the potential impact extends beyond password changes to include any operation exposed through the API. This could include data exfiltration, unauthorized modification of projects and tasks, deletion of critical business records, and further privilege escalation.

Affected Systems and Blast Radius: All Leantime deployments running version 3.9.0 or earlier are affected. The JSON-RPC API is a public-facing component, making every exposed instance potentially reachable by remote attackers who possess valid credentials. Self-hosted deployments behind corporate networks are at risk if attackers can compromise any low-privileged account. The blast radius encompasses all user accounts, project data, file uploads, client information, and any integrations connected to the Leantime instance. In multi-tenant deployments, the vulnerability could allow cross-tenant access if tenant isolation is not enforced at the dispatcher level.

CVSS Assessment: The NVD has not assigned a CVSS score or vector for this vulnerability. Based on the vulnerability mechanics — authenticated remote attack, no user interaction required, low attack complexity, and high confidentiality/integrity/availability impact — an estimated CVSS v3.1 score would likely fall in the 8.8 to 9.9 range (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) had one been assigned. The absence of an official CVSS score does not diminish the severity of this flaw.

Exploitability: The vulnerability is highly exploitable. It requires only low-privilege authentication and standard HTTP tooling. The IDOR nature of the editOwn method makes exploitation deterministic — no race conditions or heap-spraying techniques are required. The missing authorization at the dispatcher level also implies that other methods beyond editOwn are equally exploitable, expanding the attack surface considerably.

CISA KEV Status: This vulnerability is NOT on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this report. No evidence of exploitation in the wild has been confirmed by any tracked source.

Detection Guidance

The following detection rules focus on identifying anomalous JSON-RPC API behavior, particularly requests that reference user IDs other than the authenticated caller's own user ID, attempts to invoke administrative methods from low-privileged accounts, and unusual password-change patterns.

Sigma Rule

title: Leantime JSON-RPC Unauthorized User Account Modification
id: 6c1e5f2a-8e7d-4b3a-9f6b-2a1c4d5e7f8a
status: experimental
description: Detects attempts to exploit CVE-2026-76647 by invoking editOwn method with a user ID that does not match the authenticated session user in Leantime JSON-RPC API
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
  category: webserver
  product: apache
  definition: Requires access logs or web application firewall logs that capture POST bodies or application-level authentication context for Leantime instances
detection:
  selection_api_endpoint:
    cs-method: POST
    cs-uri-stem:
      - '/api/jsonrpc'
      - '/index.php/api/jsonrpc'
  selection_method_edit:
    cs-body|contains|all:
      - 'editOwn'
      - 'user_id'
      - 'password'
  selection_auth_mismatch:
    - cs-username|not equals: cs-body_user_id   # Requires WAF/log enrichment mapping session user to request body
  condition: selection_api_endpoint and selection_method_edit and selection_auth_mismatch
level: high
falsepositives:
  - Legitimate self-service password updates if the application sends the session user's own ID (depending on log enrichment accuracy)
  - API clients that maintain impersonation capabilities for support purposes
tags:
  - cve-2026-76647
  - attack.t1190
  - attack.initial-access
  - attack.privilege-escalation

YARA Rule

rule CVE_2026_76647_Leantime_Jsonrpc_Authz_Bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request patterns targeting Leantime JSON-RPC dispatcher with editOwn method and password modification parameters"
        date = "2026-05-15"
        cve = "CVE-2026-76647"
        severity = "critical"
    strings:
        $jsonrpc_endpoint = "Jsonrpc" ascii nocase
        $api_controller = "Api/Controllers" ascii nocase
        $edit_own = "editOwn" ascii nocase
        $user_id_param = "user_id" ascii nocase
        $userid_param = "userId" ascii nocase
        $userid_param2 = "userID" ascii nocase
        $password_param = "password" ascii nocase
        $set_password = "setPassword" ascii nocase
        $new_password = "new_password" ascii nocase
        $method_key = "method" ascii nocase
        $json_rpc = "jsonrpc" ascii nocase
        $json_content = "application/json" ascii nocase
        $php_controller = "Jsonrpc.php" ascii nocase
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and
        (1 of ($jsonrpc_endpoint, $api_controller, $php_controller)) and
        $edit_own and
        (1 of ($user_id_param, $userid_param, $userid_param2)) and
        (1 of ($password_param, $set_password, $new_password))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-76647 Leantime JSON-RPC Missing Authorization Attempt";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"jsonrpc";
    nocase;
    content:"editOwn";
    nocase;
    http.request_body;
    content:"user_id";
    nocase;
    distance:0;
    content:"password";
    nocase;
    distance:0;
    classtype:attempted-admin;
    reference:cve,2026-76647;
    sid:10076647;
    rev:1;
    metadata:created_at 2026_05_15, updated_at 2026_05_15;
)

Elastic Detection

// EQL for Elastic Security — detect JSON-RPC requests to Leantime API with editOwn method
sequence by source.ip, user.name with maxspan=1m
  [network where event.category == "network" and
   destination.port == 443 and network.protocol == "http"]
  [http where event.category == "http" and
   http.request.method == "POST" and
   url.path in ("/api/jsonrpc", "/index.php/api/jsonrpc")]
  [http where event.category == "http" and
   http.request.body.text contains "editOwn" and
   http.request.body.text contains "user_id" and
   http.request.body.text contains "password"]

Splunk SPL Query

index=proxy OR index=web sourcetype="access_combined" OR sourcetype="iis"
| where match(_raw, "(?i)(jsonrpc|Jsonrpc\.php)")
| where match(_raw, "(?i)editOwn")
| where match(_raw, "(?i)(user_id|userId|userID)")
| where match(_raw, "(?i)password")
| eval api_endpoint=case(
      match(_raw, "(?i)/api/jsonrpc"), "/api/jsonrpc",
      match(_raw, "(?i)/index.php/api/jsonrpc"), "/index.php/api/jsonrpc",
      match(_raw, "(?i)Jsonrpc\.php"), "/app/Domain/Api/Controllers/Jsonrpc.php",
      1=1, "unknown")
| stats count by src_ip, user, uri_path, api_endpoint
| where count > 1
| sort - count
| table _time, src_ip, user, uri_path, api_endpoint, count

Wazuh OSSEC Rule

<group name="leantime,jsonrpc,cve-2026-76647,">
  <rule id="283578" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.*(jsonrpc|Jsonrpc\.php)</field>
    <field name="method">POST</field>
    <description>Leantime JSON-RPC request containing editOwn method with user_id and password parameters - potential CVE-2026-76647 exploitation</description>
    <group>access_control,authentication_failures,attack</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has not released a fix, and no official advisory or CVE-2026-76647-specific guidance has been published.

Immediate Mitigations (in order of effectiveness):

1. Restrict JSON-RPC API access — Implement network-level access control lists (ACLs) or firewall rules to restrict access to the JSON-RPC API endpoint (/api/jsonrpc) to only trusted IP ranges or VPN connections. If the API is not business-critical, disable it entirely in the application configuration.
2. Apply application-layer authorization controls — Deploy a Web Application Firewall (WAF) with custom rules that inspect JSON-RPC request bodies and block any editOwn method calls where the user_id parameter does not match the authenticated session user. This is a stopgap measure but can mitigate the most critical exploitation path.
3. Enforce strong multi-factor authentication (MFA) — While MFA does not prevent the vulnerability itself, it adds friction to account takeover attempts. However, note that if the attacker resets a victim's password, MFA may not prevent access if the reset flow disables or bypasses MFA enrollment. Verify MFA binding behavior in your deployment.
4. Monitor for anomalous API activity — Deploy the detection rules above and alert on any JSON-RPC requests that modify user credentials or reference user IDs other than the session user. Implement baselining to detect bulk or unusual account modification patterns.
5. Audit and review user accounts — Immediately review all user accounts for unauthorized password changes or modifications. Correlate Leantime authentication logs with identity provider (IdP) logs to detect discrepancies.
6. Apply principle of least privilege — Minimize the number of users with valid credentials who can access the JSON-RPC API. Deactivate dormant accounts and rotate all API keys.

Patch/Upgrade Steps:

1. Monitor vendor channels — Subscribe to Leantime's official security advisories, GitHub releases, and mailing lists for announcements regarding a fix for CVE-2026-76647.
2. Upgrade when available — Once a patched version (expected to be > 3.9.0) is released, upgrade immediately. Test the upgrade in a staging environment first to ensure compatibility with existing integrations.
3. Temporary code-level fix (if self-hosted and feasible) — If you have development capacity and are self-hosting Leantime, consider implementing a hotfix that adds authorization checks to the app/Domain/Api/Controllers/Jsonrpc.php dispatcher. The fix should validate that the authenticated user has permission to invoke the requested method and that any user ID parameters in the request match the authenticated caller's ID (unless admin privileges are explicitly verified). Apply this hotfix with full testing and maintain it in a fork until an official patch is released.

Long-Term Hardening:

1. Architectural remediation — The root cause is the absence of centralized authorization enforcement in the dispatcher. Any long-term fix must implement a centralized authorization layer that validates permissions for every JSON-RPC method invocation before delegation to service-layer methods. This should include both method-level and resource-level authorization checks.
2. Adopt standardized authorization frameworks — Implement an authorization framework (e.g., OWASP AAA recommendations, attribute-based access control, or policy-as-code) to ensure consistent enforcement across all API endpoints.
3. Regular security audits — Conduct periodic penetration testing and code reviews focusing on API authorization mechanisms. Include IDOR testing as a standard part of the assessment methodology.
4. Identity and access management integration — Integrate Leantime with a centralized IAM solution (e.g., OIDC/SAML SSO) to ensure consistent identity verification and enable centralized audit logging and access revocation.
5. Network segmentation — Place Leantime instances in isolated network segments with restricted egress. Ensure that a compromise of the application does not provide a direct path to more sensitive internal systems.
6. Backup and incident response readiness — Maintain tested backups of Leantime data and have an incident response playbook ready for account-takeover events, including procedures for credential reset, forensic collection, and user notification.

References

1. NVD Entry — CVE-2026-76647: https://nvd.nist.gov/vuln/detail/CVE-2026-76647 (NVD description confirms missing authorization in JSON-RPC dispatcher, affected versions through 3.9.0, and distinguishes from CVE-2026-59712 and CVE-2026-15509)
2. Leantime Official Project: https://leantime.io/ (Monitor this site for vendor advisories, security announcements, and version release notes; no confirmed fix as of this report date)
3. Leantime GitHub Repository: https://github.com/Leantime/leantime (Source code location for app/Domain/Api/Controllers/Jsonrpc.php; monitor releases and security-related commits for patch availability)
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (Applicable to the exploitation of JSON-RPC API endpoints)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-76647 is NOT listed as of report date; recheck periodically for updates)

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of this report, no known threat actor campaigns have been publicly attributed to exploitation of CVE-2026-76647, and there is no confirmed exploit-in-the-wild evidence from any tracked source. The vulnerability was disclosed with an EPSS score not yet assigned by FIRST.org. Given the ease of exploitation (authenticated IDOR with direct account takeover impact) and the moderate popularity of Leantime as a self-hosted project management tool, active exploitation is considered likely once PoC code becomes publicly available. Security teams should treat this as a priority vulnerability and apply mitigations immediately despite the absence of confirmed in-the-wild exploitation.

Report generated by Valtersit Threat Intelligence. This document is intended for use by enterprise security teams and contains technical information about a known vulnerability. All intelligence is derived from the NVD description and associated CVE data provided. Updates should be monitored continuously via the referenced sources.