GHSA-99r5-84gr-59f6 Leantime has Host Header Injection Vulnerability
Attackers can manipulate host headers to view unauthorized user details in Leantime, exposing sensitive personal information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-99r5-84gr-59f6?
GHSA-99r5-84gr-59f6 is a vulnerability in leantime/leantime, published on 21 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Summary
A host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view details of other users.
Which versions are affected by GHSA-99r5-84gr-59f6?
2 open source packages ship an affected version, including leantime/leantime.
| Package | Affected | Fixed in |
|---|---|---|
leantime/leantime Packagist | All versions | 3.1.2 |
leantime/leantime Packagist | All versions | 3.1.2 |
How do I fix GHSA-99r5-84gr-59f6?
Upgrade leantime/leantime to 3.1.2 or later.
Is GHSA-99r5-84gr-59f6 being exploited?
There is no known exploitation of GHSA-99r5-84gr-59f6 in the wild and no public exploit code.