Plainpad CVE-2026-42562

Attacker must possess valid credentials for any authenticated Plainpad user account (CVSS PR:L - low-privileged user). The vulnerable endpoint /api.php/v1/users/{id} must be accessible over the network (CVSS AV:N). No special Plainpad features, non-default configurations, or administrative permissions are required - exploitation succeeds against default installations. No user interaction needed (CVSS UI:N). Limiting factors: attacker must first obtain or create a legitimate user account (via registration if enabled, credential theft, or social engineering), and the Plainpad instance must be running a version prior to 1.1.1. The vulnerability does not affect installations where user registration is fully disabled and no attacker-controlled accounts exist, though this is rarely the case for note-taking applications designed for multi-user access.

Real-world risk is HIGH for self-hosted Plainpad deployments despite moderate EPSS probability. The CVSS 8.3 score accurately reflects impact (High confidentiality and integrity, Low availability) with network attack vector, low complexity, and low privilege requirement. No user interaction needed makes this trivially exploitable by any authenticated user - including legitimate low-privilege accounts or compromised credentials. The attack is highly automatable and grants complete administrative control, enabling attackers to read all users' notes, modify application settings, create backdoor accounts, or destroy data. SSVC decision factors favor prioritization: exploitation is straightforward (public PoC not required given simplicity), technical impact is total (admin access), and mission impact depends on sensitivity of notes stored. Mitigating factors: requires self-hosted deployment (not SaaS), attacker must first obtain valid credentials (PR:L), and scope is unchanged (no cross-tenant impact). No CISA KEV listing indicates no widespread exploitation detected, but public GitHub advisory and issue disclosure significantly lower exploitation barriers. Organizations using Plainpad should treat this as urgent given the one-request privilege escalation path.

An attacker with a valid low-privilege Plainpad account (e.g., a regular user account created during normal registration) authenticates to the application and obtains a session token. They craft a PUT request to /api.php/v1/users/{their_user_id} with JSON payload {"admin": true} and submit it to the API endpoint. The server processes this request, directly assigns admin=true to the attacker's user record, and responds successfully. The attacker's next request to admin-only routes (such as user management, system settings, or bulk data export) succeeds with full administrative privileges, granting access to all users' private notes and system configuration. Given low attack complexity (CVSS AC:L), no specialized tools or deep technical knowledge required beyond basic HTTP client usage.