What’s Vulnerable › Vulnerabilities

CVE-2026-42562: Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-09 · updated 2026-07-24
• Weakness: CWE-269

Description

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.

Affected products

• alextselegidis plainpad: before 1.1.1

References

• https://github.com/alextselegidis/plainpad/commit/9216a876d27b22c3d9259551636d803f7cb075fc
• https://github.com/alextselegidis/plainpad/issues/138
• https://github.com/alextselegidis/plainpad/releases/tag/1.1.1
• https://github.com/alextselegidis/plainpad/security/advisories/GHSA-pvfv-wvpm-q6f6

Get alerted when CVE-2026-42562 or the next vulnerability affects your stack