THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-54418 (HIGH 8.1) — Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed

[NVD] CVE-2026-54418 (HIGH 8.1) — Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed

mednvdPublished 2026-08-05

CVE-2026-54418 CVSS: 8.1 HIGH Published: 2026-08-05T08:16:33.777

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

Indicators of compromise

CVE-2026-54418cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-54418