GHSA-92xh-6x7v-4rmq
Leantime allows Cross-Site Request Forgery (CSRF)
GHSA-92xh-6x7v-4rmq is a medium vulnerability (CVSS 5.9) in leantime/leantime, published February 21, 2025. No source lists public exploit code. Fixed in leantime/leantime 3.1.2.
- Severity
- 5.9 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.2leantime/leantime +1 more
Description
CSRF
Summary
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
Impact
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
leantime/leantimePackagist | before 3.1.2 | 3.1.2 |
leantime/leantimePackagist | before 3.1.2, plus listed versions 2.42.4-beta2.4-beta-72.4-beta-82.4.1 Show 45 moreShow less2.4.22.4.32.4.42.4.52.4.72.4.83.0.03.0.0-beta3.0.13.0.23.0.33.0.43.0.53.0.63.0.73.1.0-beta3.1.1v2.0v2.0.1v2.0.10v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1v2.1-betav2.1-beta2v2.1-beta3v2.1-beta5v2.1-beta6v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6 | 3.1.2 |
What each source reports
GitHub Advisories Score used
Leantime allows Cross-Site Request Forgery (CSRF)
CSRF
Summary
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
Impact
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
- Record
GHSA-92xh-6x7v-4rmq- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Leantime allows Cross-Site Request Forgery (CSRF)
CSRF
Summary
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
Impact
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
- Record
GHSA-92xh-6x7v-4rmq- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 43 versions. The JSON record has them.