CVE-2026-85990

Summary

A low-privilege authenticated user can escalate privileges to administrator by creating a new admin account and gain unauthorized access to plugin management functions. This allows attackers to install, enable, disable, or remove plugins without proper authorization.

Exploitability

Exploitation is straightforward requiring only an authenticated browser session with the X-Requested-With: XMLHttpRequest header, making it relatively easy to exploit with minimal prerequisites.

Blast radius

The impact could be significant as attackers can create administrator accounts and manipulate plugins, potentially leading to full system compromise through malicious plugin installations or privilege escalation attacks.

Detection

Monitor for unauthorized API calls to leantime.rpc.api.api.createApiKeyWithProjects endpoint and plugin management methods (installPlugin, enablePlugin, disablePlugin, removePlugin) in application logs, particularly when initiated by low-privilege users.

Prioritized remediation

Upgrade to version 3.10.0 which contains the complete fix for the permission enforcement issues in the JSON-RPC dispatcher and plugin management functions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.