What is the CVSS score of CVE-2026-42562?

CVE-2026-42562 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Plainpad are affected by CVE-2026-42562?

Plainpad versions before 1.1.1 contain a critical privilege escalation vulnerability allowing any authenticated user to elevate themselves to administrator status through a simple API request,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-42562?

Yes, a public proof-of-concept exploit is available for CVE-2026-42562. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-42562?

Within 24 hours: Identify all Plainpad deployments and document current version numbers; restrict API access to the user update endpoint via network controls or WAF rules if possible. Within 7 days: Contact Plainpad vendor for patch availability timeline and interim guidance; implement compensating controls such as disabling self-service password/profile updates if business operations permit. Within 30 days: Upgrade to Plainpad 1.1.1 or later once available; audit administrative account activity logs for unauthorized privilege changes; reset credentials for all non-administrator accounts as a precautionary measure.

Plainpad CVE-2026-42562

EUVD-2026-28929 HIGH

Improper Privilege Management (CWE-269)

2026-05-09 GitHub_M

Privilege Escalation PHP

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 09, 2026 - 21:02 EUVD

Source Code Evidence Fetched

May 09, 2026 - 20:00 vuln.today

Analysis Generated

May 09, 2026 - 20:00 vuln.today

CVE Published

May 09, 2026 - 19:09 nvd

HIGH 8.3

DescriptionGitHub Advisory

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.

AnalysisAI

Privilege escalation in Plainpad versions prior to 1.1.1 allows any authenticated user to immediately grant themselves administrator privileges via a single HTTP PUT request to the user update endpoint. The vulnerability stems from the API directly accepting the admin parameter from user input without verifying the requesting user's existing privilege level. Affected instances enable low-privilege accounts to bypass authorization controls and access admin-only functionality with no special conditions beyond basic authentication. No public exploit code or active exploitation confirmed at time of analysis, though exploitation requires minimal technical skill given the straightforward attack vector (CVSS AV:N/AC:L/PR:L).

Technical ContextAI

Plainpad is a self-hosted PHP-based note-taking application (CPE: cpe:2.3:a:alextselegidis:plainpad). The vulnerability resides in the UsersController.php update method (PUT /api.php/v1/users/{id}) which performs mass assignment of user-supplied attributes directly to the User model without proper authorization checks. The code incorrectly validated whether the authenticated user ($user) had admin rights before allowing updates, but failed to prevent any authenticated user from setting their own admin flag to true. This is a classic instance of CWE-269 (Improper Privilege Management) - the application trusts client-supplied privilege level data and applies it server-side without verifying the requester's authority to make such changes. The fix introduces a privilege check ensuring only existing administrators can modify the admin attribute, while non-admin users can still update their own non-privileged profile fields.

RemediationAI

Upgrade immediately to Plainpad version 1.1.1 or later, available at https://github.com/alextselegidis/plainpad/releases/tag/1.1.1. The patch (commit 9216a876d27b22c3d9259551636d803f7cb075fc at https://github.com/alextselegidis/plainpad/commit/9216a876d27b22c3d9259551636d803f7cb075fc) adds authorization logic preventing non-admin users from modifying the admin attribute during user profile updates. If immediate patching is not feasible, implement web application firewall (WAF) rules or reverse proxy filters to block PUT requests to /api.php/v1/users/* that contain the admin parameter in the request body from non-admin source IPs, though this workaround is fragile and bypassable if attackers control admin sessions. Alternatively, restrict API access to trusted IP ranges and audit user admin status immediately to detect any unauthorized escalations, then force password resets for all accounts - note this creates operational disruption and does not prevent re-exploitation. No workaround fully mitigates the issue; upgrade to 1.1.1 is the only complete fix.