GHSA-h6w8-27ph-c385
Leantime has Insufficiently Protected Credentials
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.
Additional Information:
1.The issue was identified during routine security testing.
2.This vulnerability poses a significant risk to user privacy and data security.
3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Leantime has Insufficiently Protected Credentials
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.
Additional Information:
1.The issue was identified during routine security testing.
2.This vulnerability poses a significant risk to user privacy and data security.
3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.
- Record
GHSA-h6w8-27ph-c385- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSV
Leantime has Insufficiently Protected Credentials
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.
Additional Information:
1.The issue was identified during routine security testing.
2.This vulnerability poses a significant risk to user privacy and data security.
3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.
- Record
GHSA-h6w8-27ph-c385- CVSS 4.0
- 5.7 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-522
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
leantime/leantimePackagist | before 3.3 | 3.3 |
leantime/leantimePackagist | before 3.3, plus listed versions 2.42.4-beta2.4-beta-72.4-beta-82.4.1 Show 45 moreShow less2.4.22.4.32.4.42.4.52.4.72.4.83.0.03.0.0-beta3.0.13.0.23.0.33.0.43.0.53.0.63.0.73.1.0-beta3.1.13.1.23.1.33.1.43.2.03.2.0-beta3.2.0-beta-23.2.1v2.0v2.0.1v2.0.10v2.0.11v2.0.12v2.0.13v2.0.14v2.0.15v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.0.8v2.0.9v2.1v2.1-betav2.1-beta2v2.1-beta3v2.1-beta5 | 3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h6w8-27ph-c385 is a medium vulnerability (CVSS 5.7) in leantime/leantime, published February 21, 2025. No source lists public exploit code. Fixed in leantime/leantime 3.3.
References
Left out here: 50 versions. The JSON record has them.