Plausible Analytics CVE-2026-119564

The attacker must already be an authenticated site editor on a Plausible Analytics Community Edition instance (≤3.2.1), and a pending invitation or ownership-transfer must currently exist, because the settings/people page exposes that invitation/transfer ID to editors. Exploitation then requires registering an account under the exact invitee email address bound to the exposed ID and accepting it to assume the invited role or site ownership. Limiting factors: it is not remote-unauthenticated - it needs the editor privilege level (PR:L) and the pre-existing pending invite/transfer (reflected as AC:H/AT:P), so instances with no outstanding invitations or no untrusted editor accounts are not exposed; impact is confined to integrity (role/ownership takeover), with no direct confidentiality or availability impact.

This is a moderate, conditionally-exploitable privilege-escalation issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) scores 6.0 and tells a coherent story: network-reachable but requiring an already-authenticated low-privileged site editor (PR:L), elevated attack complexity (AC:H), and a present attack requirement (AT:P) - namely that a pending invitation or ownership-transfer must actually exist to be abused. The only real impact is integrity (VI:H; VC:N/VA:N), matching a flaw that grants a role or site ownership rather than leaking data in bulk, even though CWE-201 labels it information exposure. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the picture of a meaningful but non-urgent fix. No EPSS score and no CISA KEV entry are present in the input, so widespread or active exploitation is not indicated. A public research write-up and a VulnCheck advisory describe the technique, so the method is documented even though no verified working exploit is confirmed. Net: prioritize for patching within the normal cycle, with attention raised for any multi-tenant/hosted Plausible instance where untrusted users hold editor roles; it is not a drop-everything issue absent further exploitation evidence.

On a shared Plausible Analytics instance, a user who already holds the site-editor role opens the settings/people page and reads the ID of a pending invitation or ownership-transfer that was addressed to someone else. The attacker registers a new account using the invitee's email address together with that exposed ID and accepts the invitation, thereby obtaining the invited role or taking over site ownership. A public PoC reference (the abraxaslabs research write-up) exists but is not verified as working exploit code; exploitation requires existing editor access (PR:L) and that such a pending invite actually exists (AC:H/AT:P).