Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Discovered CVE-2026-15518, CVE-2026-15510, and CVE-2026-15509. Unfortunately, despite responsible disclosure attempts, the vendor never responded. It's disappointing when security reports are ignored, as timely collaboration is essential for protecting users. #CyberSecurity #AppSec #VulnerabilityDisclosure #CVE
Post summary
The post announces the discovery of three CVEs and notes that the vendor failed to respond to disclosure attempts.