High severity8.8NVD Advisory· Published Apr 10, 2024· Updated Jun 17, 2026

CVE-2024-27474

Description

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.

Affected products

Leantime/Leantime3 versions
cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:leantime:leantime:3.0.6:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: <3.0.6

Patches

Vulnerability mechanics

References

github.com/dead1nfluence/Leantime-POC/blob/main/README.mdnvdExploitThird Party Advisory
drive.proton.me/urls/67VER05Z84nvdBroken Link
github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Users/Controllers/NewUser.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000