Executive brief
Leantime is a project management platform that allows teams to organize goals and tasks. A vulnerability in its plugin marketplace lets authenticated users with lower privilege roles install malicious plugins, potentially compromising the system with arbitrary code execution and data theft.
Technical details
The vulnerability is an authorization bypass in the HTMX plugin install endpoint that fails to validate user permissions before allowing plugin installation. While the marketplace GET endpoint correctly restricts access to owner/admin roles, the plugin installation endpoint lacks equivalent permission checks. Authenticated users with limited roles can make requests to install marketplace plugins and control arbitrary properties such as identifier, version, and license key, allowing them to deploy malicious plugins. The attack requires prior authentication but no additional user interaction. Leantime 3.9.6 and later contain fixes for this issue.
Affected products
- Leantime Leantime before 3.9.6
Timeline
- 2026-09-16: disclosed