-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a missing authorization check when fetching user profiles. In Leantime's architecture, user profile handling is typically managed by a Users controller. The description explicitly references a 'Host' parameter manipulation, which suggests the function uses this parameter to identify the target user but fails to validate() if the current user has permission to view that data. While the exact code isn't available, the pattern aligns with common authorization flaws in MVC frameworks where user-controlled parameters are trusted without checks. The confidence is medium due to reliance on standard vulnerability patterns and the advisory's technical description.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| leantime/leantime | composer | < 3.3 | 3.3 |
Ongoing coverage of React2Shell