A Server-Side Request Forgery vulnerability in Leantime allows authenticated attackers to potentially access sensitive internal resources, necessitating an immediate update.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring within the blueprints import functionality. An attacker with low-level authenticated access can manipulate requests to force the application to interact with unintended internal or external systems.

Successful exploitation of this flaw allows attackers to bypass network perimeters and interact with internal services that are not exposed to the public internet. With a CVSS score of 8.5, this high-severity vulnerability poses a significant risk to data confidentiality and internal network integrity, potentially leading to unauthorized data exfiltration or internal service compromise.

Immediate Action: Update Leantime to version 3.6.2 or later to apply the necessary security patches.

Proactive Monitoring: Review application access logs for unusual outbound requests originating from the server, particularly those targeting internal IP addresses or sensitive local services.

Compensating Controls: Implement strict egress filtering on the host server to limit outbound connections to only necessary and trusted external endpoints.

Public Exploit Available: No (no confirmed public weaponized exploit or Metasploit module exists).

Given the high CVSS severity score, organizations using Leantime should prioritize upgrading to version 3.6.2 immediately. Securing the blueprints import feature is critical to preventing unauthorized lateral movement within the network.