Description

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-21T12:17:27.177Z",
  "pubdate": "2026-09-21T12:17:27.177Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Hyve5 Leantime versions up to 3.9.8 within the Kanban Board component.\nThe vulnerability allows an unauthenticated or authenticated remote attacker to inject and execute malicious JavaScript code within the context of a victim's browser session.\nThis flaw stems from improper neutralization of input within the 'getAllGrouped' function in the 'app/Domain/Tickets/Services/Tickets.php' file.\nSuccessful exploitation could lead to unauthorized actions performed on behalf of the user, session hijacking, or data theft, posing a significant risk to organizational information security.\nThe vulnerability is remotely exploitable, and a public exploit exists, increasing the risk of active exploitation.",
  "technicalDetails": "The vulnerability resides in the 'getAllGrouped' function located within 'app/Domain/Tickets/Services/Tickets.php', which handles data retrieval for the Kanban Board component in Hyve5 Leantime versions up to 3.9.8.\nThe root cause of the vulnerability is the failure of the application to properly sanitize or encode user-controllable input before rendering it in the browser UI.\nWhen the Kanban Board retrieves ticket data via 'getAllGrouped', it incorrectly trusts the data retrieved from the database or source. If an attacker can inject malicious script payloads into ticket fields that are subsequently processed by this function, the application renders this content without adequate output encoding.\nThe attack flow begins with the injection of a malicious XSS payload into a field processed by the 'getAllGrouped' function. This could occur through ticket creation or editing interfaces that lack sufficient input validation.\nWhen a victim, such as an administrator or another user, navigates to the Kanban Board, the application executes the 'getAllGrouped' function to populate the view. The malicious payload is retrieved and directly injected into the Document Object Model (DOM) of the victim's browser.\nBecause the payload is rendered within the context of the authenticated user's session, the injected JavaScript executes with the victim's permissions. This allows the attacker to bypass Same-Origin Policy (SOP) restrictions, steal session cookies, capture sensitive information displayed on the page, or perform unauthorized operations within the application via the victim's authenticated browser.\nThe vulnerability is remotely exploitable and does not require complex infrastructure, making it highly accessible to attackers. Publicly available exploit code further facilitates potential compromise of vulnerable instances."
}