CVE-2026-66412
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects
CVSS
6.5
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 27 jul 2026 · Última mod.: 27 jul 2026 · CWE-639
Sin historial EPSS suficiente todavía.
Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.
- github.comhttps://github.com/Leantime/leantime/commit/68898eeb914882a21797523f2782914795bc67ae
- github.comhttps://github.com/Leantime/leantime/pull/3657
- github.comhttps://github.com/Leantime/leantime/security/advisories/GHSA-wv69-xr82-phr6
- www.vulncheck.comhttps://www.vulncheck.com/advisories/leantime-all-versions-prior-to-and-broken-access-control-via-tickets-getmilestone-json-rpc
- github.comhttps://github.com/Leantime/leantime/pull/3657
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-59240——
———The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the system. The controller retrieves the target record with `Notification::findOrFail($id)` and deletes it without validating `user_id` or `company_id` ownership, unlike the sibling `SetNotificationReadAjaxController`, which correctly scopes lookups by `Auth::id()`. Because notification identifiers are sequential, an attacker can iterate over IDs to systematically delete notifications belonging to any user, denying them visibility of ticket alerts, task assignments, and other system events.2hCVE-2026-480525.4 MED—
———Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handler verifies the caller's membership of the ":organizationId" in the URL, but the repository write filters on tag.id alone, so the URL-level org scope never reaches the database. This issue has been patched in version 26.5.0.5hCVE-2026-175704.3 MED—
———Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
This issue affects :
* Devolutions Server 2026.2.4.0 through 2026.2.12.0
* Devolutions Server 2026.1.23.0 and earlier4hCVE-2026-175315.0 MED—
———A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.4hCVE-2026-595467.4 ALT—
———Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.7hCVE-2026-595397.5 ALT—
———Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.7h