shouldiuse.io

Categories

VERDICT

Leantime Review

Depends

Should I use Leantime?

Leantime: Free, open-source project management software designed for ADHD, ADD, and all brains, streamlining tasks, boosting productivity & collaboration. - leantime.io

· 1 month ago

A good buy for small teams, non-profits, and self-hosters who want free, structured project management. Not for buyers who need vendor support, a demo, or hardened enterprise security.

Confidence

Medium. Based on 40+ public sources; some review snippets truncated, and pricing listings conflict.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Self-hosted (open source)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Cloud plans$5–$12.49/user/mo depending on source

Best for

  • Small self-hosting teams
  • Non-profits
  • ADHD/ADD users wanting structure
  • Startups replacing ClickUp or Asana cheaply

Not for

  • Enterprises needing compliance-grade security
  • Teams wanting vendor-managed updates and support
  • Buyers who need a demo before purchase
  • Large orgs with complex PMO processes

Gotchas - check before you buy

high

Self-hosted updates are not automatic; outdated installs stay exposed to known CVEs.

medium

No demo before buying; plugin prices buried on the site.

low

Pricing listings conflict ($5 vs $12.49/user/mo) — confirm current rates before signup.

low

Managed hosting is sold separately; DIY self-hosting burdens are entirely yours.

Pros and cons

Pros

  • Free, open source; self-host with no license costs
  • Designed for non-project managers and ADHD/ADD brains
  • 4.7/5 G2 rating across ~235 reviews
  • Users praise the idea-to-action workflow
  • Estimated 25,500+ installations

Cons

  • Some self-hosters reported it 'quite buggy'
  • No demo; plugin pricing hard to find
  • Multiple 2025–2026 CVEs, including authentication bypass
  • Tiny vendor (~$120K raised); limited support depth
  • Polarized feedback: G2 fans vs skeptical self-hosters

Sources & method

- 14 sources - Multiple CVEs in 2025–2026, including authentication bypass, broken access control, and XSS — patch fast if self-hosting.

official x3review x6security x3news x2
  • CVE-2026-54418: Authentication bypass, Authentication bypass vulnerability disclosed August 2026.
  • Privilege escalation in Leantime ≤3.8.0, Broken access control (CWE-862) lets low-privilege users escalate to owner.
  • CVE-2025-28254: XSS, Cross-site scripting vulnerability in v3.2.1 and before, authenticated users.
  • CVE-2026-59713: OIDC login CSRF, CSRF vulnerability in OIDC login verification flow, July 2026.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free self-hosting; cheap cloud tiers
  • Ease of use: 4/5. Built for non-project managers; older bug gripes
  • Feature depth: 3/5. Solid core; extras gated behind plugins
  • Support quality: 2/5. No demo; opaque plugin pricing
  • Security posture: 2/5. Repeated auth bypass and access-control CVEs
  • 4.7/5 G2 rating 235 reviews; other sources cite 4.5
  • $5/user/mo Starting price cloud; listings vary to $12.49
  • Yes Free tier open source, self-hosted
  • 25,500+ Installations company estimate, 2024

Pricing

Self-hosted (open source)

Free

  • Full open-source system
  • You host, maintain, and patch

Cloud plans

$5–$12.49/user/mo depending on source

  • Hosted by Leantime
  • Annual billing ~$8/user/mo per one listing

Security

Multiple CVEs in 2025–2026, including authentication bypass, broken access control, and XSS — patch fast if self-hosting.

  • CVE-2026-54418: Authentication bypassAuthentication bypass vulnerability disclosed August 2026.⁸
  • Privilege escalation in Leantime ≤3.8.0Broken access control (CWE-862) lets low-privilege users escalate to owner.
  • CVE-2025-28254: XSSCross-site scripting vulnerability in v3.2.1 and before, authenticated users.⁹
  • CVE-2026-59713: OIDC login CSRFCSRF vulnerability in OIDC login verification flow, July 2026.

What users say

G2 raters like the idea-to-action flow (4.7/5), while some r/selfhosted users found it buggy and the site unhelpful.

“I love how LeanTime works to help move you from ideas to actions”
G2 review
“I really wanted to like Leantime, and I do like the look and feel, but it'”
Reddit, r/selfhosted
“Overall Leantime seems quite buggy still, it's a shame really because a”
Reddit, r/selfhosted

Alternatives

Compare Leantime with each alternative.

  • OpenProject

    Larger open-source suite marketed directly as a Leantime alternative.

  • ClickUp

    Polished commercial PM; top-named Leantime alternative on G2.

  • monday.com

    Heavier commercial work platform G2 lists as alternative.

    Leantime vs monday.com

  • Redmine

    Bare-bones self-hosted tracker r/selfhosted compares it against.

Full analysis

Based on 40+ public sources; some review snippets truncated, and pricing listings conflict.

Free self-hosted PM for small, ADHD-friendly teams — but a CVE streak and tiny vendor make it risky for anything sensitive.

Methodology

Based on 40+ public sources; some review snippets truncated, and pricing listings conflict.

Read how a report is made.

Sources

  1. Leantime official siteleantime.io
    official
  2. Leantime on GitHubgithub.com
    official
  3. Leantime G2 reviewsg2.com
    review
  4. Leantime on SaaSworthy/SpotSaaSspotsaas.com
    review
  5. Reddit: Leantime vs Redmine opinionsreddit.com
    review
  6. Reddit: Leantime v2.4 release threadreddit.com
    review
  7. Reddit: Leantime alternative threadreddit.com
    review
  8. CVE-2026-54418 auth bypasssentinelone.com
    security
  9. CVE-2025-28254 XSS detailnvd.nist.gov
    security
  10. TurnKey GNU/Linux update warningturnkeylinux.org
    security
  11. SiliconAngle: 25,500 installationssiliconangle.com
    news
  12. Leantime funding profilestartupintros.com
    news
  13. Leantime pricing breakdownfindpmsoftware.com
    review
  14. OpenProject Leantime alternative pageopenproject.org
    official

Add this review to your site

This check for Leantime says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Leantime Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.