CVE-2026-66416— Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66416
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
Source: CVE Program / CVE List V5
Vulnerability Description
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, PUT, and DELETE requests that create or delete projects, modify settings, and change permissions as any authenticated user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Leantime 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Leantime是Leantime公司开源的一个面向非项目经理的以目标为中心的项目管理系统。 Leantime 3.6.2之前版本存在跨站请求伪造漏洞，该漏洞源于排除Laravel VerifyCsrfToken中间件，容易受到跨站请求伪造攻击，可能导致攻击者代表已认证用户创建或删除项目、修改设置、更改权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-66416
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 6614 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-66416
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66416 (1)
Vendor Advisories for CVE-2026-66416 (1)
Proof of Concept for CVE-2026-66416 (1)
Other References for CVE-2026-66416 (1)
Same Patch Batch · Leantime · 2026-07-30 · 3 CVEs total
| CVE-2026-66415 | 8.5 HIGH | Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() |
| CVE-2026-66414 | 6.1 MEDIUM | Leantime Open Redirect in Login Controller via redirectUrl Parameter |
IV. Related Vulnerabilities
Same product: Leantime
- CVE-2026-66415
Leantime Server-Side Request Forgery and Local File Inclusio - CVE-2026-66414
Leantime Open Redirect in Login Controller via redirectUrl P - CVE-2026-66412
Leantime all versions prior to and 3.6.2 Broken Access Contr - CVE-2026-15510
Leantime API saveSetting improper authorization - CVE-2026-15509
Leantime JSON-RPC Endpoint addUser improper authorization
Same vendor: Leantime
- CVE-2026-66415
Leantime Server-Side Request Forgery and Local File Inclusio - CVE-2026-66414
Leantime Open Redirect in Login Controller via redirectUrl P - CVE-2026-66412
Leantime all versions prior to and 3.6.2 Broken Access Contr - CVE-2026-59712
Leantime - JSON-RPC API Broken Access Control via users.getU - CVE-2026-59713
Leantime - OIDC Login CSRF via Unconditional State Verificat
Same weakness: CWE-352
- CVE-2026-69093
Admidio before 5.0.11 CSRF via category-report preferences - CVE-2026-69082
Cross-Site Request Forgery in the Administrative User Deleti - CVE-2026-15988
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege - CVE-2025-14469
Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modi - CVE-2025-67651
CSRF in PHP Jabbers scripts
V. Comments for CVE-2026-66416
No comments yet