CVE-2026-92772: Leantime HTMX Auth Bypass Vulnerability

CVE-2026-92772 Overview

CVE-2026-92772 is an authorization bypass vulnerability in Leantime before version 3.9.6. The flaw resides in the HTMX plugin install endpoint, which fails to enforce role-based permission checks. Authenticated users with limited roles can install marketplace plugins and control arbitrary plugin properties, including the identifier, version, and license key. Attackers can leverage this weakness to deploy malicious plugins into the Leantime instance, undermining the integrity of the application. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact

Any authenticated low-privileged user can install attacker-controlled plugins, enabling deployment of malicious code and full compromise of Leantime application integrity.

Affected Products

• Leantime versions prior to 3.9.6
• HTMX plugin install endpoint (app/Domain/Plugins/Hxcontrollers/Details.php)
• Leantime Marketplace plugin installation flow (app/Domain/Plugins/Services/Plugins.php)

Discovery Timeline

• 2026-09-16 - CVE-2026-92772 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92772

Vulnerability Analysis

Leantime exposes plugin management functionality through both a standard Marketplace controller and an HTMX-based controller for asynchronous interactions. The Marketplace controller in version 3.9.5 performs a role validation check before permitting plugin installation. The HTMX Details controller responsible for installing marketplace plugins omits this equivalent permission check. As a result, any authenticated user, regardless of assigned role, can invoke the install endpoint. The parameters passed to the underlying Plugins service are attacker-controlled, including the plugin identifier, version string, and license key value, allowing installation of arbitrary plugin definitions rather than only trusted marketplace entries.

Root Cause

The root cause is missing authorization enforcement in the HTMX install handler. In version 3.9.5, the handler at app/Domain/Plugins/Hxcontrollers/Details.php lines 25-40 accepts installation requests without validating that the current session belongs to a user with administrative or plugin-management privileges. The fix introduced in 3.9.6 adds the required permission check at line 27, aligning the HTMX flow with the guarded Marketplace controller path.

Attack Vector

An authenticated user with any role sends a crafted HTMX request to the plugin install endpoint. The request supplies chosen values for the plugin identifier, version, and license key. The Plugins service processes these inputs and performs the installation without verifying either caller privilege or plugin authenticity. Because plugins execute within the Leantime application context, a malicious plugin package can introduce backdoors or tamper with data.

No verified proof-of-concept code is publicly available. See the VulnCheck Advisory on Leantime and Leantime Issue #3757 for further technical detail.

Detection Methods for CVE-2026-92772

Indicators of Compromise

• Unexpected entries in the Leantime plugins directory or plugin database table that do not correspond to administrator-approved installations.
• HTTP requests to the HTMX plugin Details install route originating from user sessions that do not hold administrative roles.
• Plugin records containing unusual identifier, version, or license key values that do not match legitimate marketplace listings.

Detection Strategies

• Audit web server access logs for POST requests to the HTMX plugin install endpoint and correlate the requesting user's role with the action performed.
• Compare the installed plugin inventory against a known-good baseline maintained by administrators.
• Enable Leantime application-level audit logging where available and alert on plugin lifecycle events (install, enable, update).

Monitoring Recommendations

• Forward Leantime application and web server logs to a centralized SIEM for correlation of privilege context with plugin management actions.
• Monitor filesystem changes under the Leantime plugins directory using file integrity monitoring.
• Track outbound network connections initiated by the PHP process hosting Leantime for unexpected destinations that may indicate malicious plugin activity.

How to Mitigate CVE-2026-92772

Immediate Actions Required

• Upgrade Leantime to version 3.9.6 or later, which introduces the missing permission check in the HTMX Details controller.
• Review the current plugin inventory and remove any plugin that cannot be attributed to an authorized administrator installation.
• Rotate any plugin license keys or secrets that may have been exposed through unauthorized installation attempts.

Patch Information

The upstream fix is present in Leantime 3.9.6. The change adds authorization enforcement at line 27 of app/Domain/Plugins/Hxcontrollers/Details.php. Refer to the Leantime Hxcontrollers Details Update and the Leantime GitHub Repository for the release containing the fix.

Workarounds

• Restrict access to the Leantime application to trusted authenticated users only until the upgrade to 3.9.6 is applied.
• Place the Leantime instance behind a reverse proxy or web application firewall and block requests to the HTMX plugin install route from non-administrative sessions.
• Audit user accounts and remove or downgrade any accounts that do not require access, reducing the pool of principals capable of exploiting the flaw.

# Configuration example: restrict HTMX plugin install route at the reverse proxy layer
# Example nginx location block denying access to the vulnerable endpoint pending patching
location ~* /plugins/details/install {
    deny all;
    return 403;
}