CVE-2026-85990

Executive Summary

CVE-2026-85990 is a privilege-escalation and broken-access-control vulnerability in Leantime, an open-source project management system, affecting all versions prior to 3.10.0. The JSON-RPC dispatcher (app/Domain/Api/Controllers/Jsonrpc.php) exposes public API service methods, and PermissionEnforcer::enforce permits methods that lack a RequiresPermission attribute. Any low-privilege authenticated user with an ordinary browser session can abuse the leantime.rpc.api.api.createApiKeyWithProjects method to create an interactive administrator account via an attacker-chosen role, and can invoke plugin-management methods (Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, Plugins::removePlugin) without authorization. Successful exploitation yields full administrative control of the Leantime instance, including the ability to install malicious plugins — a direct route to remote code execution depending on plugin content.

Technical Analysis

The vulnerability resides in Leantime's authorization model for its JSON-RPC surface. The dispatcher at app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods over the JSON-RPC interface. Access control for those methods is delegated to PermissionEnforcer::enforce, which — per the NVD description — allows methods that do not carry a RequiresPermission attribute. The authorization logic therefore fails open: any callable method lacking the attribute is treated as permitted rather than denied.

This is a classic instance of CWE-269 (Improper Privilege Management). The security decision is driven by the absence of metadata (a missing attribute) instead of the presence of an explicit grant, so methods unintentionally left unannotated become reachable by any authenticated principal.

The concrete exposure is twofold:

1. Account-creation surface: Calling leantime.rpc.api.api.createApiKeyWithProjects reaches Api::createApiKeyWithProjects. Because the method accepts an attacker-chosen role, a low-privilege authenticated user can supply an administrative role and create an interactive administrator account. This converts a low-privilege session into a full administrative identity.

2. Plugin-management surface: The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. Plugin installation is especially dangerous because installed plugin code executes within the Leantime application context.

The attack requires only an ordinary authenticated browser session. Note the requirement in the description that the request carry the X-Requested-With: XMLHttpRequest header — a mechanism Leantime uses to distinguish legitimate AJAX/JSON-RPC traffic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network reachability, low attack complexity, low privilege requirement, no user interaction, and high confidentiality, integrity, and availability impact.

The description characterizes these as a "provisionally grouped" issue — meaning the account-creation and plugin-management exposures share a single root cause (the missing per-method authorization enforcement) and are fixed together in version 3.10.0.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the mechanisms explicitly named in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a reachable Leantime instance (self-hosted or otherwise exposed) running a version prior to 3.10.0. The attacker must first possess a valid low-privilege authenticated account — obtained through self-registration, a provisioned seat, or prior compromise — and an ordinary browser session.

2. Triggering the flawed authorization path. The attacker issues JSON-RPC requests to the Leantime JSON-RPC dispatcher, including the X-Requested-With: XMLHttpRequest header required by the browser-based flow. Because PermissionEnforcer::enforce permits methods lacking a RequiresPermission attribute, the attacker is not blocked by an authorization check on the exposed methods.

3. Privilege escalation via account creation. The attacker invokes leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects. By specifying an attacker-chosen administrative role in the call, the attacker creates an interactive administrator account. The attacker can then authenticate as that administrator.

4. Unauthorized plugin management. Using the same missing authorization, the attacker invokes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin. Installing and enabling a plugin gives the attacker a mechanism to introduce attacker-controlled code and to tamper with or disable existing plugins (integrity and availability impact).

5. Post-exploitation impact. With administrative access, the attacker controls all projects, data, users, and configuration in the Leantime instance. Plugin installation/enabling may yield execution of attacker-supplied code within the application context, depending on plugin content — a potential pivot to the underlying host and adjacent services.

Impact Assessment

CVE-2026-85990 carries a CVSS 3.1 base score of 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• Confidentiality (C:H): An attacker who escalates to administrator can read all project data, user records, and configuration managed by the Leantime instance.
• Integrity (I:H): The attacker can create privileged accounts, modify projects and users, and install/enable/disable/remove plugins arbitrarily.
• Availability (A:H): Plugin removal/disablement and administrative control over the instance enable disruption of service.
• Scope (S:U): The impact is scoped to the vulnerable Leantime application; however, plugin code execution can extend impact beyond the application boundary depending on plugin behavior and deployment.
• Attack Requirements: Network reachable (AV:N), low complexity (AC:L), requires a low-privilege authenticated session (PR:L), no user interaction (UI:N).

Business impact. Leantime deployments frequently store sensitive project plans, internal documentation, customer deliverables, and credentials. Full administrative compromise exposes this data wholesale and enables persistent control via malicious plugins (a supply-chain-style foothold inside the organization's tooling). Because exploitation requires only a low-privilege account and no user interaction, any organization that permits Leantime account self-registration or has many non-privileged users effectively extends the attack surface broadly.

Blast radius. All Leantime instances prior to 3.10.0. The primary risk asset is the Leantime application and its data; the secondary and potentially higher-severity risk is the host and network if attacker-supplied plugin code executes. No CISA KEV listing and no public exploit are currently recorded, and no EPSS score has been assigned by FIRST.org, so observed exploitation in the wild is not established as of this report.

Detection Guidance

Sigma Rule

title: Leantime JSON-RPC Unauthorized Method Invocation (CVE-2026-85990)
id: 9f2a7c10-4b1e-4e2a-9d3c-6a7f85990001
status: experimental
description: Detects JSON-RPC requests to Leantime invoking privileged methods lacking per-method authorization, including createApiKeyWithProjects and plugin management methods.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85990
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_method:
    cs-uri-query|contains:
      - 'leantime.rpc.api.api.createApiKeyWithProjects'
      - 'Plugins::installPlugin'
      - 'Plugins::enablePlugin'
      - 'Plugins::disablePlugin'
      - 'Plugins::removePlugin'
  selection_header:
    cs-headers|contains: 'X-Requested-With: XMLHttpRequest'
  condition: selection_method
fields:
  - c-ip
  - cs-uri-query
  - cs-headers
falsepositives:
  - Legitimate administrators performing plugin management
  - Automated provisioning of API keys by trusted tooling
level: high

YARA Rule

rule CVE_2026_85990_Leantime_Jsonrpc_Abuse
{
    meta:
        description = "Detects Leantime JSON-RPC exploitation attempts and markers for CVE-2026-85990 in HTTP logs and request bodies"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85990"
        date = "2026-01-01"
        severity = "high"

    strings:
        $rpc = "leantime.rpc.api.api.createApiKeyWithProjects" ascii wide nocase
        $m1  = "Plugins::installPlugin" ascii wide nocase
        $m2  = "Plugins::enablePlugin" ascii wide nocase
        $m3  = "Plugins::disablePlugin" ascii wide nocase
        $m4  = "Plugins::removePlugin" ascii wide nocase
        $ajax = "X-Requested-With: XMLHttpRequest" ascii wide nocase
        $disp = "app/Domain/Api/Controllers/Jsonrpc.php" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or
        any of ($rpc, $m1, $m2, $m3, $m4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85990 Leantime JSON-RPC Unauthorized Privileged Method Invocation"; flow:established,to_server; http.method; content:"POST"; http.header; content:"X-Requested-With"; content:"XMLHttpRequest"; http.request_body; content:"createApiKeyWithProjects"; nocase; reference:cve,2026-85990; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85990; classtype:attempted-admin; sid:90085990; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where event.type == "start" and
     network.protocol == "http" and
     http.request.method == "POST" and
     http.request.body.text : ("createApiKeyWithProjects" or "installPlugin"
        or "enablePlugin" or "disablePlugin" or "removePlugin")]
  [process where event.action == "start" and
     process.name != null and
     process.executable != null]

Splunk SPL Query

index=web_logs sourcetype=access_combined OR sourcetype=proxy
| eval raw_lower = lower(_raw)
| where match(raw_lower, "leantime\.rpc\.api\.api\.createapikeywithprojects")
    OR match(raw_lower, "installplugin")
    OR match(raw_lower, "enableplugin")
    OR match(raw_lower, "disableplugin")
    OR match(raw_lower, "removeplugin")
| eval suspicious_header = if(match(raw_lower, "x-requested-with: xmlhttprequest"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(suspicious_header) as ajax_header
        values(clientip) as client_ip
        values(uri) as uri
  by user, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="leantime,web,access_control,">
  <rule id="100900" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>leantime\.rpc\.api\.api\.createApiKeyWithProjects</url>
    <description>CVE-2026-85990: Leantime JSON-RPC privileged method createApiKeyWithProjects invoked (possible privilege escalation).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,privilege_escalation,</group>
  </rule>

  <rule id="100901" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <regex>Plugins::(installPlugin|enablePlugin|disablePlugin|removePlugin)</regex>
    <description>CVE-2026-85990: Leantime JSON-RPC plugin-management method invoked without per-method authorization.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,plugin_management,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict network exposure of Leantime: place the instance behind an authenticated reverse proxy, VPN, or IP allowlist so that only trusted users can reach the JSON-RPC surface.
• Disable or tightly control account self-registration so that the population of low-privilege authenticated users — the required starting point for exploitation — is minimized.
• Audit existing accounts for unexpectedly elevated roles, and review the plugin directory for unauthorized or unrecognized plugins (consistent with unauthorized use of Plugins::installPlugin/Plugins::enablePlugin).
• Because per the description the fix is the addition of per-method authorization (RequiresPermission enforcement in PermissionEnforcer::enforce), treat all pre-3.10.0 instances as affected until verified.

2) Patch / upgrade steps

• Upgrade to Leantime 3.10.0 or later, where the provisionally grouped account-creation and plugin-management issue is documented as fixed (per the NVD description).
• After upgrading, verify version in the Leantime UI/CLI and re-test that JSON-RPC calls to leantime.rpc.api.api.createApiKeyWithProjects and the plugin-management methods are denied for non-administrative users.
• Rotate credentials and API keys associated with any account that may have been created or modified during a suspected exploitation window; review audit logs for account creation and plugin changes.

3) Long-term hardening

• Enforce a default-deny authorization model for API dispatchers: methods should require an explicit permission attribute, and unannotated methods should be rejected rather than allowed.
• Implement CI checks / unit tests that assert authorization coverage across dispatchable methods to prevent regressions of the "missing attribute" class.
• Apply least privilege to plugin management, log all plugin install/enable/disable/remove operations, and require elevated approval workflows for these actions.
• Add monitoring/alerting for privileged JSON-RPC method invocation by low-privilege principals, and integrate the detection rules above into SOC pipelines.

References

• NVD — CVE-2026-85990: https://nvd.nist.gov/vuln/detail/CVE-2026-85990
• Leantime project (vendor): https://leantime.io — verify the 3.10.0 release notes/advisory for the complete fix
• CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• FIRST EPSS: No score assigned as of this report — https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog: Not listed as of this report — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or exploit-in-the-wild evidence is currently recorded for CVE-2026-85990, and no associated threat actor campaigns have been identified in the provided data.