CVE-2026-92772

Executive Summary

CVE-2026-92772 is an authorization bypass (Missing Authorization, CWE-862) in the HTMX plugin install endpoint of Leantime, affecting all versions before 3.9.6. Authenticated users holding limited roles can invoke the plugin installation functionality without permission validation and supply attacker-controlled plugin properties — including identifier, version, and license key — to install and deploy a malicious plugin from the marketplace. Successful exploitation yields high integrity impact (arbitrary plugin deployment, effectively code execution within the application context) and limited availability impact, with a CVSS base score of 7.1.

Technical Analysis

The vulnerability resides in the HTMX-driven plugin installation endpoint of Leantime. HTMX is a frontend library that issues asynchronous HTTP requests to server-side endpoints and swaps returned HTML fragments into the DOM; endpoints exposed for HTMX consumption are frequently implemented as lightweight handlers that trust the session context rather than re-validating authorization on each request.

Per the NVD description, the install endpoint "lacks permission validation." This is a textbook instance of CWE-862 (Missing Authorization): the application authenticates the request (the actor must be an authenticated user) but does not verify that the authenticated principal holds the privilege required to perform plugin installation. Plugin installation in Leantime is an administrative, security-sensitive operation because plugins are code that executes within the application runtime and can extend or alter application behavior, access data stores, and reach the underlying host depending on deployment.

The second, compounding flaw is that attacker-controlled properties are accepted during installation. The description explicitly names three such properties — identifier, version, and license key. By controlling the identifier, an attacker can direct the installation flow to reference an attacker-chosen package identity rather than a vetted marketplace artifact; by controlling the version, the attacker can select a specific (potentially malicious or vulnerable) artifact version; and by controlling the license key, the attacker can satisfy or bypass whatever licensing gate the install flow applies. The net result is that a low-privileged authenticated user can cause the platform to fetch and deploy a plugin that the attacker effectively selects, giving the attacker an execution primitive inside the Leantime instance.

Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, the flaw requires only low privileges (PR:L — any authenticated account with a limited role), no user interaction, and is network-reachable. The scope is unchanged (S:U), meaning impact is contained to the Leantime security authority. Confidentiality is scored None (C:N) because the installation itself is an integrity action; the confidentiality consequences (if any) would flow from what the malicious plugin subsequently does, which is beyond the scored vector. Integrity is High (I:H) because arbitrary plugin deployment directly modifies the trusted execution state of the application. Availability is Low (A:L), reflecting potential disruption from a poorly behaved or resource-consuming plugin rather than guaranteed denial of service.

No specific function names, route paths, parameter names beyond identifier/version/license key, or code snippets are provided in the NVD description, and none are fabricated here. The precise HTTP route, request method, and parameter encoding for the install endpoint are not disclosed in the available intelligence.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None; no Nuclei template). The attack chain below is inferred from the vulnerability class (CWE-862 missing authorization) and the properties named verbatim in the NVD description. Steps:

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Leantime instance and confirms the version is below 3.9.6. Because the plugin install endpoint is HTMX-driven, the attacker maps the application's HTMX request surface (requests that return HTML fragments rather than full pages) to locate the plugin management functionality. Any Leantime deployment reachable by an authenticated low-privilege account is in scope.

2. Authentication with a low-privilege account. The attacker obtains or is issued a legitimate but limited-role account — for example a standard project member, contractor, or any role not normally permitted to manage plugins. Per PR:L, no administrative access is required.

3. Triggering the authorization flaw. The attacker sends a request to the plugin install endpoint. The endpoint authenticates the session but performs no permission check, so the low-privilege principal is treated as authorized to install plugins. No privilege escalation step is needed — the missing check is the entire bypass.

4. Payload / execution method (vulnerability-class level). In the same install request, the attacker supplies attacker-controlled plugin properties: the identifier (selecting which plugin/package identity is installed), the version (selecting the exact artifact version), and the license key (satisfying or circumventing the licensing gate applied by the install flow). By controlling these values, the attacker causes the platform to install a plugin they control or one that is malicious/vulnerable, rather than a vetted artifact. Execution occurs when the newly installed plugin is loaded and run by Leantime.

5. Post-exploitation impact. Once a malicious plugin is deployed and loaded, the attacker holds code execution within the Leantime application context. From there, the plugin can persist across restarts, exfiltrate data the application can reach, pivot toward the database or connected integrations, and tamper with application logic. Integrity impact is High; availability impact is Low (potential service degradation or disruption from the plugin).

Impact Assessment

Business impact centers on the loss of trust in the Leantime instance's administrative boundary. A user who should never be able to modify the platform's installed extensions can deploy arbitrary plugin code, meaning the "plugin administrator" privilege is effectively granted to every authenticated account. For organizations using Leantime as a project management and collaboration platform, this exposes project data, attached files, user directories, and any integrations reachable by the application, with high integrity impact per the CVSS subscores (I:H). Because the plugin executes inside the application trust boundary, downstream confidentiality loss is plausible even though the scored C:N reflects only the install action itself.

Blast radius is any Leantime deployment below 3.9.6 that permits untrusted or low-privilege authenticated users. Multi-tenant or externally shared instances (clients, contractors, vendors invited into the platform) are at elevated risk because the PR:L precondition is trivially satisfied. Scope is unchanged (S:U), so impact is bounded to the Leantime security authority rather than directly to the host, though a malicious plugin can attempt to escape that boundary. EPSS is not yet scored by FIRST.org, so exploitation-likelihood weighting cannot be quantified from EPSS at this time. The flaw is not listed in CISA KEV, and no in-the-wild exploitation is reported.

Detection Guidance

Sigma Rule

title: Leantime Unauthorized Plugin Installation via HTMX Endpoint (CVE-2026-92772)
id: 3f9a7c02-6b1e-4d5a-9c47-92772a1b0d10
status: experimental
description: Detects requests to the Leantime plugin install endpoint by low-privilege users, indicating exploitation of missing authorization (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92772
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: leantime
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'plugin'
  selection_install:
    cs-uri-query|contains|all:
      - 'identifier'
      - 'version'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_install and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrators installing plugins through the plugin marketplace UI
level: medium

YARA Rule

rule CVE_2026_92772_Leantime_Malicious_Plugin
{
    meta:
        description = "Detects suspicious Leantime plugin artifacts referencing CVE-2026-92772 exploitation via unauthorized install properties"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92772"
        date = "2026-01-01"
        severity = "high"

    strings:
        $leantime = "leantime" ascii nocase
        $plugin   = "plugin" ascii nocase
        $ident    = "identifier" ascii nocase
        $version  = "version" ascii nocase
        $license  = "license" ascii nocase

    condition:
        uint32(0) == 0x04034b50 and
        $leantime and $plugin and
        2 of ($ident, $version, $license)
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-92772 Leantime Unauthorized Plugin Install Attempt"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.uri; content:"plugin"; nocase; \
  http.uri; content:"identifier"; nocase; \
  http.uri; content:"version"; nocase; \
  classtype:attempted-admin; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92772; \
  sid:9277201; rev:1; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; \
)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "POST"
    and url.path : "*plugin*"]
  [http where http.request.method == "POST"
    and url.path : "*plugin*"
    and url.query contains "identifier"
    and url.query contains "version"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower=lower(uri)
| where match(uri_lower, "plugin") AND match(uri_lower, "identifier") AND match(uri_lower, "version")
| where method="POST"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(status) as statuses by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,leantime,">
  <rule id="927720" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>plugin</url>
    <regex>identifier=.*version=</regex>
    <description>CVE-2026-92772: Possible Leantime unauthorized plugin install attempt via HTMX endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92772,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states that the issue is resolved in Leantime 3.9.6, but no vendor advisory, commit, or OSV entry confirming the fix is present in the tracked sources; treat the version boundary as the description's claim and verify against the vendor's own release channel before relying on it.

1. Immediate mitigations.

   • Restrict network access to Leantime instances so that only trusted networks and known users can reach the plugin management surface. Do not expose the admin/plugin functionality to untrusted or shared user populations.
   • Audit all authenticated accounts and downgrade or disable accounts that should not exist; the PR:L precondition means any valid low-privilege account is a viable exploit identity.
   • If the plugin install endpoint can be blocked at the reverse proxy or WAF for non-administrative users, apply a deny rule (e.g., block POST requests containing plugin identifier/version parameters from non-admin sessions). This directly neutralizes the missing-authorization check.
   • Monitor for unexpected plugins and review installed plugin inventory against an allowlist.

2. Patch/upgrade steps.

   • Upgrade to Leantime 3.9.6 or later per the NVD description. Confirm the fix through the vendor's release notes and repository before treating it as authoritative, given patch confidence 0/4.
   • After upgrading, re-audit the plugin directory for any artifacts installed while the instance was vulnerable.

3. Long-term hardening.

   • Enforce server-side authorization on every HTMX/plugin endpoint, not just UI gating — the missing check is the root cause (CWE-862).
   • Validate and allowlist plugin identifier, version, and license key values server-side; never let a client supply the artifact identity or version directly.
   • Deploy the detection rules above and alert on plugin installation events that do not correlate with a known administrative session.
   • Maintain version inventory and subscribe to the vendor's security advisories for timely future patches.

References

• NVD — CVE-2026-92772: https://nvd.nist.gov/vuln/detail/CVE-2026-92772
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Leantime project (vendor release channel; verify 3.9.6 fix): https://github.com/Leantime/leantime
• FIRST EPSS (CVE not yet scored at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild: none reported. CVE-2026-92772 is not in CISA KEV, no public PoC or exploit code is available, and no threat actor activity is associated with this CVE in the provided intelligence.