CVE-2026-92772: Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-17
Weakness: CWE-862

Description

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.

Affected products

Leantime: before 3.9.6 — fixed in 3.9.6

How to fix

Upgrade to a fixed version: Leantime 3.9.6. Check the vendor advisory for mitigations.

References

https://github.com/Leantime/leantime
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Controllers/Marketplace.php#L24
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Hxcontrollers/Details.php#L25-L40
https://github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Services/Plugins.php#L546-L561
https://github.com/Leantime/leantime/blob/v3.9.6/app/Domain/Plugins/Hxcontrollers/Details.php#L27
https://github.com/Leantime/leantime/issues/3757
https://www.vulncheck.com/advisories/leantime-before-3.9.6-unauthorized-plugin-installation-via-htmx
https://github.com/Leantime/leantime/issues/3757

Get alerted when CVE-2026-92772 or the next vulnerability affects your stack