Vulnerability Description
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Leantime/leantime
- https://github.com/Leantime/leantime/commit/4f2612d13e0e8a2093092a846b44506cf133
- https://github.com/Leantime/leantime/issues/3556
- https://www.vulncheck.com/advisories/leantime-credential-disclosure-via-unauthen
FAQ
What is CVE-2026-59712?
CVE-2026-59712 is a vulnerability with a CVSS score of 8.1 (HIGH). Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and ...
How severe is CVE-2026-59712?
CVE-2026-59712 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59712?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.