CVE-2026-66416

This is not a typical CSRF vulnerability. Most CSRF bugs involve a single endpoint that forgot to validate tokens — this one is an order of magnitude different in scope. The VerifyCsrfToken middleware was removed from the global middleware stack in Kernel.php, which means every single route in Leantime lost CSRF protection unless someone manually added it back to individual controllers. One configuration change stripped protection from the entire application. The fact that this was an active exclusion — someone removed or commented out the middleware, rather than simply forgetting to add it — is the critical detail. This almost certainly happened during development when a developer encountered a token mismatch error (common with async JavaScript, cross-origin forms, or third-party webhooks) and found the quickest fix was to disable protection globally. That change then shipped, and because Laravel's middleware lives in Kernel.php — a file developers rarely touch after initial setup — nobody noticed the protection was gone. The blast radius is substantial. Leantime is project management infrastructure: it stores credentials for GitHub, GitLab, and Slack integrations, holds client data, roadmaps, and team structures. A successful CSRF attack against an authenticated admin session can silently restructure project permissions, modify user roles, or alter integration settings. Unlike credential theft, this leaves no forensic trace — the action appears in logs as a legitimate admin command from a valid session. Detection is straightforward but requires intent. Check your Kernel.php file for the VerifyCsrfToken middleware — if it's absent from the $middlewareGroups['web'] array, you're vulnerable. You can also search commit history for modifications to Kernel.php that coincided with feature work, particularly any commits mentioning 'token mismatch' or 'CSRF'. The absence of this middleware is the vulnerability; there's no subtle variant to hunt for. Remediation is more involved than patching. Re-enabling VerifyCsrfToken globally will fix the vulnerability, but if that's what broke your workflows originally, the same friction returns. Audit your application for state-changing endpoints that use AJAX, handle cross-origin requests, or interface with external webhooks — these are the places where CSRF tokens commonly cause issues. The sustainable fix addresses the workflow, not just the security setting. After patching, verify that legitimate operations (creating projects, modifying settings, user management) still work as expected.

Reviewed through automated stages and approved by a human before publication.