Leantime versions prior to 3.6.2 are vulnerable to a Cross-Site Request Forgery attack that could lead to full unauthorized account or system control.

The application fails to implement the Laravel VerifyCsrfToken middleware globally, allowing an unauthenticated attacker to execute unauthorized actions on behalf of a user through Cross-Site Request Forgery.

The exploitation of this vulnerability poses a severe risk to organizational data integrity and system availability. With a CVSS score of 8.8, this flaw allows attackers to perform administrative actions without consent, potentially resulting in unauthorized data modification or administrative account takeover.

Immediate Action: Upgrade to Leantime version 3.6.2 or later to apply the necessary CSRF protection middleware.

Proactive Monitoring: Review web server access logs for unusual patterns of POST requests originating from external sources that do not correlate with legitimate user activity.

Compensating Controls: Deploy a Web Application Firewall with strict CSRF protection rules to inspect and filter incoming traffic until the software update can be applied.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for unauthorized administrative actions, immediate patching is required. Administrators should prioritize upgrading to version 3.6.2 to ensure the missing CSRF protections are properly enforced.