CVE-2026-42562

HighCVSS 8.3

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Plainpad prior to version 1.1.1 allows a low-privilege authenticated user to escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input.

Risk Assessment

Any authenticated user can gain full administrative privileges, leading to complete application compromise and data access.

Recommendation

Update Plainpad to version 1.1.1 or later.

Other vulnerabilities in Plainpad

CVE-2026-73529Medium
Plainpad through 1.1.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint. Dead code in App\Http\Kernel.php leaves the throttle configuration unattached. Attackers can also cause CPU exhaustion via repeated bcrypt comparisons.

Original NVD description (English source)

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.