CyberRota Analysis
AI-GeneratedLeantime versions prior to 3.9.6 are vulnerable due to an authorization bypass in the HTMX plugin install endpoint, allowing authenticated users with limited roles to install malicious marketplace plugins. This vulnerability enables attackers to manipulate critical properties such as identifier, version, and license key, potentially compromising the integrity of the application. Organizations using Leantime should prioritize patching to mitigate the risk of unauthorized plugin installations and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.