What is CVE-2026-66416?
This vulnerability is a CSRF flaw in Leantime version 3.6.2, caused by excluding Laravel's VerifyCsrfToken middleware from the global stack in app/Http/Kernel.php. Unauthenticated attackers can perform state-changing actions on behalf of authenticated users. Users should immediately update the application and review the middleware configuration.
Azərbaycanca: Bu boşluq Leantime 3.6.2 versiyasında aşkarlanmış CSRF zəifliyidir. Laravel-in VerifyCsrfToken middleware-inin global stack-dən çıxarılması səbəbindən autentifikasiya olunmamış hücumçular, autentifikasiya olunmuş istifadəçilər adından state-changing əməliyyatlar icra edə bilər. İstifadəçilərə dərhal proqramı yeniləmək və middleware konfiqurasiyasını yoxlamaq tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-352
FAQ1
What is the root cause of the CVE-2026-66416 vulnerability in Leantime 3.6.2?
The vulnerability is caused by excluding Laravel's VerifyCsrfToken middleware from the global stack, allowing unauthenticated attackers to perform state-changing actions on behalf of authenticated users.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.