Summary
Leantime versions before 3.10.0 insufficiently authorize several JSON-RPC methods exposed through the account and plugin-management surfaces. An authenticated low-privilege user may be able to create an administrator account or manage plugins when the dispatcher permits methods without method-level permission requirements.
Leantime versions before 3.10.0 insufficiently authorize several JSON-RPC methods exposed through the account and plugin-management surfaces. An authenticated low-privilege user may be able to create an administrator account or manage plugins when the dispatcher permits methods without method-level permission requirements.
Affected context
The issue occurs in Leantime deployments where the JSON-RPC dispatcher exposes API and plugin-management methods without consistently enforcing per-method permissions. Risk is present when an ordinary authenticated user can reach the dispatcher with the expected browser request context and invoke methods such as account creation or plugin management.
The issue occurs in Leantime deployments where the JSON-RPC dispatcher exposes API and plugin-management methods without consistently enforcing per-method permissions. Risk is present when an ordinary authenticated user can reach the dispatcher with the expected browser request context and invoke methods such as account creation or plugin management.
Exploit preconditions
- Attack surface: Leantime's authenticated JSON-RPC API
- Required access: A valid low-privilege authenticated browser session
- Trigger point: Invocation of insufficiently protected account-creation or plugin-management methods
- Relevant request context: The request must satisfy the application's expected AJAX request conditions, including the required
X-Requested-With: XMLHttpRequestheader - Why exploitation is possible: The permission enforcement logic permits methods that do not declare a required permission, allowing ordinary users to reach privileged operations
- Attack surface: Leantime's authenticated JSON-RPC API
- Required access: A valid low-privilege authenticated browser session
- Trigger point: Invocation of insufficiently protected account-creation or plugin-management methods
- Relevant request context: The request must satisfy the application's expected AJAX request conditions, including the required
X-Requested-With: XMLHttpRequestheader - Why exploitation is possible: The permission enforcement logic permits methods that do not declare a required permission, allowing ordinary users to reach privileged operations
Why this happens
The underlying flaw is inconsistent authorization at the API method boundary. The JSON-RPC dispatcher exposes public service methods, while PermissionEnforcer::enforce allows methods lacking a RequiresPermission attribute to proceed. This creates a fail-open access-control pattern in which the absence of an explicit permission requirement is treated as authorization rather than denial. The issue maps primarily to CWE-862: Missing Authorization and is also related to CWE-269: Improper Privilege Management.
The underlying flaw is inconsistent authorization at the API method boundary. The JSON-RPC dispatcher exposes public service methods, while PermissionEnforcer::enforce allows methods lacking a RequiresPermission attribute to proceed. This creates a fail-open access-control pattern in which the absence of an explicit permission requirement is treated as authorization rather than denial. The issue maps primarily to CWE-862: Missing Authorization and is also related to CWE-269: Improper Privilege Management.
Potential impact
- An authenticated user may create an interactive administrator account
- An attacker could escalate from a low-privilege account to administrative control
- Unauthorized users may install, enable, disable, or remove plugins
- Malicious plugins could alter application behavior or expose project data
- Administrative control could facilitate further compromise of the Leantime instance
- An authenticated user may create an interactive administrator account
- An attacker could escalate from a low-privilege account to administrative control
- Unauthorized users may install, enable, disable, or remove plugins
- Malicious plugins could alter application behavior or expose project data
- Administrative control could facilitate further compromise of the Leantime instance
General mitigation guidance
Mitigation generally focuses on enforcing authorization as a mandatory server-side property of every sensitive API method.
Common defensive patterns include:
- Deny access by default when a method lacks an explicit authorization requirement
- Require distinct permissions for account creation, role assignment, and plugin lifecycle operations
- Validate requested roles and prevent low-privilege users from assigning administrative privileges
- Apply authorization checks at both the dispatcher and business-logic layers
- Restrict plugin installation to trusted administrators and approved sources
- Use least-privilege roles and minimize the capabilities of authenticated user accounts
- Treat request headers and client-side indicators as routing signals, not authorization controls
Mitigation generally focuses on enforcing authorization as a mandatory server-side property of every sensitive API method.
Common defensive patterns include:
- Deny access by default when a method lacks an explicit authorization requirement
- Require distinct permissions for account creation, role assignment, and plugin lifecycle operations
- Validate requested roles and prevent low-privilege users from assigning administrative privileges
- Apply authorization checks at both the dispatcher and business-logic layers
- Restrict plugin installation to trusted administrators and approved sources
- Use least-privilege roles and minimize the capabilities of authenticated user accounts
- Treat request headers and client-side indicators as routing signals, not authorization controls
How teams detect issues like this
Organizations can look for:
- Static analysis rules identifying RPC methods without explicit permission metadata
- Code review findings where missing authorization attributes result in access being allowed
- Tests that exercise sensitive methods using ordinary authenticated roles
- Audit logs showing unexpected API-key creation, role assignment, or plugin lifecycle events
- Policy checks requiring deny-by-default authorization for administrative API operations
- Automated security testing that compares method reachability across role levels
Organizations can look for:
- Static analysis rules identifying RPC methods without explicit permission metadata
- Code review findings where missing authorization attributes result in access being allowed
- Tests that exercise sensitive methods using ordinary authenticated roles
- Audit logs showing unexpected API-key creation, role assignment, or plugin lifecycle events
- Policy checks requiring deny-by-default authorization for administrative API operations
- Automated security testing that compares method reachability across role levels
