rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-92772

Leantime versions prior to 3.9.6 contain an authorization bypass vulnerability in the HTMX plugin installation endpoint. Due to missing perm

Overview

Leantime versions prior to 3.9.6 contain an authorization bypass vulnerability in the HTMX plugin installation endpoint. Due to missing permission validation, authenticated users with low-level privileges can install arbitrary marketplace plugins and manipulate installation parameters. Updating to version 3.9.6 resolves the issue by enforcing strict permission checks.

Description

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.

Impact

Authenticated users with restricted roles can bypass authorization checks to install arbitrary plugins. This compromises system integrity and confidentiality, and could lead to server compromise if a malicious plugin is deployed.

Remediation

Update Leantime to version 3.9.6 or later. Restrict network access to management interfaces where applicable and audit currently installed plugins to ensure no unauthorized extensions were deployed prior to patching.

Risk context

Assigned a CVSS score of 7.1 (High). While authentication is required to trigger the vulnerability, low-privileged users can exploit missing authorization checks to perform administrative actions.

Affected products

  • Leantime Leantime (< 3.9.6)

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

Leantime Authorization Bypass Broken Access Control Plugin Management Patch Required CVE-2026-92772

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis