Security Advisory

CVE-2026-92772

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-16 20:32:33

Last updated 2026-09-17 14:52:22

Assigner VulnCheck

CVSS score 7.1

State PUBLISHED

Description

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.

← Browse all CVEs View on cve.org ↗