CVE-2026-66412

If you run Leantime, the vulnerability you need to understand is not the one endpoint—it's the architectural pattern that made it possible. CVE-2026-66412 allows any authenticated user to retrieve milestone data from projects they don't belong to by simply enumerating sequential integer IDs against the `tickets.getMilestone` JSON-RPC endpoint. This isn't a clever exploit. It's the API doing exactly what its design permits: integer IDs are used directly in queries because they're convenient, not because they're safe. The critical question for defenders is not whether to patch this endpoint—you should—but whether this is an isolated flaw or a systemic pattern. The JSON-RPC abstraction that makes Leantime's API developer-friendly also concentrates data access in ways that make authorization auditing harder. The convenience that lets you call `tickets.getMilestone` without thinking about SQL also lets you forget to check whether the caller should see that milestone. This is the same architectural seduction that produced broken object-level authorization in GraphQL APIs. Assume other endpoints are vulnerable until proven otherwise. Audit every JSON-RPC method that accepts integer IDs—tickets, projects, users, boards—for the same enumeration pattern. The fix should not be scoped to one endpoint; it should be a sweep through the data access layer to understand where project membership is actually enforced versus where it is assumed. One more thing worth noting: the CVSS score reflects technical exploitability, not intelligence value. Project timelines, milestone descriptions, and planning data reveal strategic intent that doesn't decay. Knowing a competitor's 18-month roadmap is valuable today and will remain valuable in three years. If you're running Leantime in an environment where competitive intelligence matters—consultants, contractors, partner access—the severity of this vulnerability exceeds what the CVSS formula captures.

Reviewed through automated stages and approved by a human before publication.