CVE-2026-66416

Katalog CVE

CVSS 8.8 · High EPSS 0,26%

Kerentanan Cross-Site Request Forgery (CSRF). Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

31 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Leantime/leantime
• https://github.com/Leantime/leantime/pull/3659
• https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-x8vx-9g5w-w5rr
• https://www.vulncheck.com/advisories/leantime-csrf-protection-globally-disabled-by-omission-of-laravel-verifyc...