GHSA-92xh-6x7v-4rmq Leantime allows Cross-Site Request Forgery (CSRF)
A CSRF vulnerability allows attackers to create high-privilege accounts by tricking administrators into clicking a malicious link.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-92xh-6x7v-4rmq?
GHSA-92xh-6x7v-4rmq is a vulnerability in leantime/leantime, published on 21 Feb 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
CSRF
Summary
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
Impact
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
Which versions are affected by GHSA-92xh-6x7v-4rmq?
2 open source packages ship an affected version, including leantime/leantime.
| Package | Affected | Fixed in |
|---|---|---|
leantime/leantime Packagist | All versions | 3.1.2 |
leantime/leantime Packagist | All versions | 3.1.2 |
How do I fix GHSA-92xh-6x7v-4rmq?
Upgrade leantime/leantime to 3.1.2 or later.
Is GHSA-92xh-6x7v-4rmq being exploited?
There is no known exploitation of GHSA-92xh-6x7v-4rmq in the wild and no public exploit code.