CVE-2026-119564

22th percentile - higher than 22% of all known CVEs

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.

An attacker can take over site ownership or gain an unauthorized role, leading to full control over the site and its data. This poses a serious threat to integrity and confidentiality.

Update Plausible Analytics Community Edition to a version later than 3.2.1. Until patched, restrict access to the settings/people page and monitor invitation activations.