HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-66416 — Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows u...

·Source: NIST NVD

Updated:

Executive Summary

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, P

Analysis

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user. CVSS Score: 8.8. Published: 2026-07-30T19:18:36.340.

Indicators of Compromise (1)

CVE (1)
CVE-2026-66416
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

NatWest appoints LSEG's Triona O’Keeffe chief data and analytics officer

NatWest has recruited London Stock Exchange executive Triona O’Keeffe as its new chief data and analytics officer as part of a move to bring its data, AI and engineering capabilities closer together.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-66421 — OpenClaw Dashboard contains a stored cross-site scripting vulnerability that all...

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with

CVE-2026-66421
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-66420 — MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass v...

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of th

CVE-2026-66420
NIST NVD