CVE-2026-66412
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects
CVSS
6.5
Medio
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Publicado: 27 jul 2026 · Última mod.: 28 jul 2026 · CWE-639
0.2%EPSS · 30 días0.3%
2026-08-142026-09-10
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
- github.comhttps://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae
- github.comhttps://github.com/Leantime/leantime/pull/3657
- github.comhttps://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
- www.vulncheck.comhttps://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc
- github.comhttps://github.com/Leantime/leantime/pull/3657
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-542586.5 MED—
———ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.14hCVE-2026-494648.1 ALT—
———NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks15hCVE-2026-81916——
———Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope, potentially polluting protected datasets, triggering workflows, or injecting content into administrative processes. The dashboard submit route resolved the mutated entity from the attacker-controlled route ID while the permission check validated the independently posted form's entity, and the submission proceeded because the two entities were never compared. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.16hCVE-2026-81915——
———Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), so a signed-in dashboard user permitted to edit one Page Type could modify the configuration of Page Types outside their assigned authorization boundary. The update_page_type token was validated but is action- and user-scoped rather than object-scoped, so it did not constrain which Page Type could be targeted. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.16hCVE-2026-621405.3 MED—
———Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.15hCVE-2026-621344.3 MED—
———Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.15h