CVE-2024-27474

Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.65% chance of exploitation in the next 30 days, 50th percentile

Published

2024-04-10

Updated

2024-08-21

Proof-of-concept exploits (1)

• dead1nfluence/Leantime-POC0★ · 2025-08-20

Security advisories

• dead1nfluence/Leantime-POC/blob/main/README.md
• Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Users/Controll…

References

• CVE Record
• NVD entry

Related

• CVE-2024-27476
• CVE-2024-27477
• CVE-2025-11644
• CVE-2025-11645
• CVE-2025-11646
• CVE-2025-11647