Description
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.
References8
- github.com/Leantime/leantime
- github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Con…
- github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Hxc…
- github.com/Leantime/leantime/blob/v3.9.5/app/Domain/Plugins/Ser…
- github.com/Leantime/leantime/blob/v3.9.6/app/Domain/Plugins/Hxc…
- github.com/Leantime/leantime/issues/3757
- www.vulncheck.com/advisories/leantime-before-3.9.6-unauthorized…
- github.com/Leantime/leantime/issues/3757
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - CVSS 4.0
-
7.1
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 45 · as of 8 November 2026
- CWE
- CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.