Main
Vulnerability Database
Exploits
ID:13110 - Exploit for Authorization bypass through user-controlled key in Leantime
ID:13110 - Exploit for Authorization bypass through user-controlled key in Leantime
Published: October 5, 2026
Vulnerability identifier: #VU153271
Vulnerability risk: Medium
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Vulnerable software:
Leantime
Leantime
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper authorization in the self-service profile update functionality. A remote user can change another user's password and takeover target account.
Remediation
Install updates from vendor's website.