Authorization Bypass in Leantime HTMX Plugin Installation

Leantime versions prior to 3.9.6 are susceptible to an authorization bypass vulnerability (CVE-2026-92772) located within the HTMX plugin installation endpoint. The application fails to properly validate the permissions of users attempting to access the plugin installation interface. As a result, an authenticated user with limited role-based access can successfully interact with this endpoint to install marketplace plugins. An attacker can manipulate configuration properties, including plugin identifiers, versions, and license keys, to force the application to install unauthorized or malicious code. This vulnerability poses a significant risk to organizations as it enables attackers to move from a low-privileged account to achieving arbitrary code execution or persistence within the application environment. Defenders should prioritize patching Leantime to version 3.9.6 or later to enforce correct access control checks on the HTMX plugin installation process.

Impact

Successful exploitation of this vulnerability allows unauthorized users to deploy arbitrary plugins, leading to potential remote code execution, unauthorized data access, and persistent backdoors within the Leantime environment. This affects all organizations using Leantime versions earlier than 3.9.6 that permit standard user account creation or have exposed the application to untrusted internal actors.

Recommendation

• Patch Leantime to version 3.9.6 or later immediately to resolve CVE-2026-92772.
• Audit application logs for unauthorized plugin installation requests, specifically monitoring access to the HTMX plugin installation endpoint for users without administrative privileges.
• Review existing plugin manifests to ensure no unauthorized or unrecognized plugins have been installed within the environment.