{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "JSON-RPC API",
          "vendor": "Leantime",
          "versions": [
            {
              "lessThanOrEqual": "3.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user\u0027s account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T19:26:46.137Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover"
        },
        {
          "url": "https://vokecyber.com/blog/leantime-jsonrpc-editown-account-takeover"
        },
        {
          "url": "https://leantime.io/unlocking-leantimes-power-a-guide-to-the-json-rpc-api/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Leantime JSON-RPC API contains a missing authorization vulnerability",
      "x_generator": {
        "engine": "VINCE 3.0.44",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-76647"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-76647",
    "datePublished": "2026-08-19T19:26:46.137Z",
    "dateReserved": "2026-08-19T15:24:24.418Z",
    "dateUpdated": "2026-08-19T19:26:46.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-76647",
      "date": "2026-08-24",
      "epss": "0.00165",
      "percentile": "0.05857"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-76647\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2026-08-19T20:17:24.013\",\"lastModified\":\"2026-08-19T20:17:24.013\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or act on resources outside their intended permissions. For example, the editOwn method accepts a user-supplied user ID without verifying that it belongs to the caller, allowing an attacker to modify another user\u0027s account and set a new password, resulting in account takeover. This vulnerability is distinct from CVE-2026-59712 and CVE-2026-15509 because the root cause is the lack of centralized authorization enforcement in the JSON-RPC dispatcher rather than the behavior of an individual exposed method.\"}],\"affected\":[{\"source\":\"cret@cert.org\",\"affectedData\":[{\"vendor\":\"Leantime\",\"product\":\"JSON-RPC API\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"3.9.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://leantime.io/unlocking-leantimes-power-a-guide-to-the-json-rpc-api/\",\"source\":\"cret@cert.org\"},{\"url\":\"https://vokecyber.com/blog/leantime-jsonrpc-editown-account-takeover\",\"source\":\"cret@cert.org\"},{\"url\":\"https://vokecyber.com/research/leantime-jsonrpc-editown-account-takeover\",\"source\":\"cret@cert.org\"}]}}"
  }
}