{"metadata": {"vulnerability": "CVE-2026-85990", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-04T19:17:36.245Z", "date_only": false, "value": "2026-09-04T19:17:36.245Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85990", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-13T16:15:09.529Z", "date_only": false, "value": "2026-10-13T16:15:09.529Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85990", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T16:15:09.529Z", "date_only": false, "value": "2026-10-13T16:15:09.529Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-85990", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:23:43.106Z", "date_only": false, "value": "2026-10-13T16:23:43.106475Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117434523494697126", "record": "CVE-2026-85990", "field": "creation_timestamp", "uuid": "67661c53-a79e-4844-ad02-eed79fb373a8", "content": "CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-85990https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wphttps://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wphttps://github.com/Leantime/leantime/pull/3583https://github.com/Leantime/leantime/pull/3797https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43ehttps://github.com/Leantime/leantime/releases/tag/v3.10.0#Leantime #leantime#CVE_2026_85990#bot", "url": "https://infosec.exchange/users/cve/statuses/117434523494697126"}, {"timestamp": "2026-10-13T17:17:47Z", "date_only": false, "value": "2026-10-13T17:17:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-54MM-6729-R5WP", "record": "GHSA-54MM-6729-R5WP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T17:17:47.707Z", "date_only": false, "value": "2026-10-13T17:17:47.707", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85990", "record": "FKIE_CVE-2026-85990", "field": "published"}, {"timestamp": "2026-10-13T17:20:40.782Z", "date_only": false, "value": "2026-10-13T17:20:40.782864Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxrk6dgvi72e", "record": "CVE-2026-85990", "field": "creation_timestamp", "uuid": "7ca18b2f-4592-45dc-a845-575921b64620", "content": "\ud83d\udfe0 CVE-2026-85990 - High (8.8)\n\nLeantime is an open source project management system. Prior to 3.10.0, for the provisionally grou...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-85990/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxrk6dgvi72e"}, {"timestamp": "2026-10-15T20:14:43Z", "date_only": false, "value": "2026-10-15T20:14:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-54MM-6729-R5WP", "record": "GHSA-54MM-6729-R5WP", "field": "published"}, {"timestamp": "2026-10-15T20:14:43Z", "date_only": false, "value": "2026-10-15T20:14:43Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-54MM-6729-R5WP", "record": "GHSA-54MM-6729-R5WP", "field": "modified"}, {"timestamp": "2026-10-16T22:07:42.946Z", "date_only": false, "value": "2026-10-16T22:07:42.946920Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85990", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T22:07:42.946Z", "date_only": false, "value": "2026-10-16T22:07:42.946920Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85990", "record": "FKIE_CVE-2026-85990", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T22:08:17.288Z", "date_only": false, "value": "2026-10-16T22:08:17.288Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85990", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:08:17.288Z", "date_only": false, "value": "2026-10-16T22:08:17.288Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85990", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T23:17:02.333Z", "date_only": false, "value": "2026-10-16T23:17:02.333", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85990", "record": "FKIE_CVE-2026-85990", "field": "lastModified"}]}