CVE-2026-54418 — Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

CVE-2026-54418

Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass PUBLISHED

Description (CNA)

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

Affected (CNA)

Vendor / product	Versions
Leantime / Leantime	affected 0 through 3.6.2

CWE

CWE-862

References

https://github.com/Leantime/leantime

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.