CVE-2026-92772

EUVD-2026-81036
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
leantimeleantime
𝑥
< 3.9.6
CNA
Common Weakness Enumeration
References
https://github.com/Leantime/leantime
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Controllers/Marketplace.php#L24
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Hxcontrollers/Details.php#L25-L40
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Services/Plugins.php#L546-L561
https://github.com/Leantime/leantime/blob/v3.9.6/app/Domain/Plugins/Hxcontrollers/Details.php#L27
https://github.com/Leantime/leantime/issues/3757
https://www.vulncheck.com/advisories/leantime-before-3.9.6-unauthorized-plugin-installation-via-htmx