Cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*

Leantime versions prior to 3.9.6 contain an authorization bypass vulnerability in the HTMX plugin installation endpoint, allowing low-privileged authenticated users to deploy arbitrary plugins.