CyberRota Analysis
AI-GeneratedThe Users::getUser method in Leantime's JSON-RPC API is vulnerable due to insufficient authorization checks, enabling authenticated users to access sensitive information, including password hashes and session tokens, for any user account. This flaw poses a significant risk of credential theft, offline password cracking, and session hijacking. Organizations using Leantime should prioritize immediate remediation to protect user data and prevent potential account compromises.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.