CVE-2026-92772: Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Leantimeto a version that resolves this vulnerability.Fixed in 3.9.6 - Compensating control
Mitigate unauthorized plugin installation by preventing users with limited roles from accessing the HTMX plugin install endpoint (block or restrict access so permission validation is enforced) until the system is upgraded to 3.9.6.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user assigned a limited role may be able to exploit it. The vulnerable HTMX plugin installation endpoint does not validate permissions before allowing marketplace plugin installation.
What does an attacker need to do?
The attacker needs valid authentication to Leantime; no user interaction is required. They can control plugin properties such as the identifier, version, and license key to deploy a malicious plugin.
Are deployments using the affected versions exposed by default?
The issue is in the HTMX plugin install endpoint because it lacks permission validation. Deployments running Leantime versions before 3.9.6 are affected where authenticated limited-role users can reach that endpoint.
How can administrators identify possible exploitation?
Review plugin installation activity for installations initiated by limited-role accounts, especially plugins with unexpected identifiers, versions, or license keys. The provided data does not identify specific log records or indicators beyond plugin installation activity.