CVE-2026-92772

Leantime before 3.9.6 contains an authorization bypass (CWE-862) in its HTMX plugin install endpoint, which lacks permission validation. Any authenticated user with a limited or low-privilege role can call this network-reachable endpoint and install plugins from the marketplace, fully controlling arbitrary properties including the plugin identifier, version, and license key. By abusing this, an attacker can deploy a malicious or attacker-controlled plugin onto the server, compromising the integrity of the installation (CVSS 4.0: 7.1 High, network vector, low privileges, no user interaction). All Leantime deployments running a version earlier than 3.9.6 that host low-privileged user accounts are affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade Leantime to version 3.9.6 or later, which adds the missing permission validation on the plugin install endpoint. Until patched, review which low-privileged users hold accounts on the instance and audit the installed plugin list for unrecognized identifiers, versions, or license keys. Limit network exposure of the Leantime instance to trusted users as an interim mitigation.