CVE-2026-85990 | Leantime up to 3.9.x JSON-RPC Dispatcher Jsonrpc.php role privileges management

October 13, 2026 Yanac

A vulnerability described as critical has been identified in Leantime up to 3.9.x. The affected element is the function createApiKeyWithProjects/installPlugin/enablePlugin/disablePlugin/removePlugin of the file app/Domain/Api/Controllers/Jsonrpc.php of the component JSON-RPC Dispatcher. The manipulation of the argument role results in improper privilege management.

This vulnerability is identified as CVE-2026-85990. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More