CVE-2026-92772— Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX
Quick assessment
Affected
Leantime leantime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Leantime 3.9.6 之前的版本中存在一个授权绕过漏洞：HTMX 插件安装端点缺少权限验证。具有有限角色的已认证用户可以安装市场插件，并能控制包括标识符（identifier）、版本（version）和许可证密钥（license key）等任意属性，从而部署恶意插件。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92772
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX
Source: CVE Program / CVE List V5
Vulnerability Description
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92772
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92772
请登录查看更多情报信息。
Other References for CVE-2026-92772 (5)
IV. Related Vulnerabilities
Same product: leantime
-
CVE-2026-94211
Hyve5 Leantime Project Dashboard show.blade.php cross site s -
CVE-2026-94210
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross -
CVE-2026-54418
Leantime - Missing Authorization on TwoFA JSON-RPC Methods A -
CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La -
CVE-2026-66415
Leantime Server-Side Request Forgery and Local File Inclusio
Same vendor: Leantime
-
CVE-2026-76647
Leantime JSON-RPC API contains a missing authorization vulne -
CVE-2026-54418
Leantime - Missing Authorization on TwoFA JSON-RPC Methods A -
CVE-2026-66416
Leantime CSRF Protection Globally Disabled by Omission of La -
CVE-2026-66415
Leantime Server-Side Request Forgery and Local File Inclusio -
CVE-2026-66414
Leantime Open Redirect in Login Controller via redirectUrl P
Same weakness: CWE-862
-
CVE-2026-39783
WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure -
CVE-2026-103684
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access -
CVE-2026-94669
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Br -
CVE-2026-39763
WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broke -
CVE-2026-39721
WordPress Starter Templates plugin <= 4.7.7 - Broken Access
V. Comments for CVE-2026-92772
No comments yet