GHSA-3hfj-qcvj-4hx8: Leantime has Missing Authorization Check for Host Parameter

The vulnerability stems from a missing authorization check when fetching user profiles. In Leantime's architecture, user profile handling is typically managed by a Users controller. The description explicitly references a 'Host' parameter manipulation, which suggests the function uses this parameter to identify the target user but fails to validate() if the current user has permission to view that data. While the exact code isn't available, the pattern aligns with common authorization flaws in MVC frameworks where user-controlled parameters are trusted without checks. The confidence is medium due to reliance on standard vulnerability patterns and the advisory's technical description.