Authorization Bypass Vulnerability in Leantime by Leantime
CVE-2026-92772

7.1HIGH

Key Information:

Vendor: Leantime
Status: Leantime
Vendor: CVE Published:; 16 September 2026

What is CVE-2026-92772?

Leantime versions prior to 3.9.6 are susceptible to an authorization bypass vulnerability within the HTMX plugin install endpoint. This flaw allows authenticated users with limited permissions to install marketplace plugins, granting them control over critical properties such as identifiers, versions, and license keys. Consequently, a malicious actor could leverage this vulnerability to deploy harmful plugins, undermining the security integrity of the system.