EUVD-2026-28929CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionNVD
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.
AnalysisAI
Privilege escalation in Plainpad versions prior to 1.1.1 allows any authenticated user to immediately grant themselves administrator privileges via a single HTTP PUT request to the user update endpoint. The vulnerability stems from the API directly accepting the admin parameter from user input without verifying the requesting user's existing privilege level. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Plainpad deployments and document current version numbers; restrict API access to the user update endpoint via network controls or WAF rules if possible. Within 7 days: Contact Plainpad vendor for patch availability timeline and interim guidance; implement compensating controls such as disabling self-service password/profile updates if business operations permit. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today