EUVD-2026-62737Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
A valid signed non-admin token is required (PR:L), the flaw crosses from user to admin authority within the instance (S:C), and admin API grants full read/write plus pad deletion (C:H/I:H/A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
AnalysisAI
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth user invoke instance-wide admin functions. The flaw is a broken authorization check in the /api/2/* handler that treats the mere presence of the admin claim as sufficient, ignoring that OAuth2Provider issues admin: false for non-admin users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Etherpad instance to be running the OAuth2 authorization_code flow (src/node/security/OAuth2Provider.ts) and the attacker to possess a valid, correctly signed token for a configured non-admin user - i.e., the attacker must be an authenticated, provisioned account, not anonymous. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mostly aligned toward high priority but with one important caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An organization runs Etherpad with OAuth login for staff. A rank-and-file employee (or an attacker who has phished any low-privilege account) obtains their normal signed access token and sends it to /api/2/listAllPads and /api/2/getText, then to setHTML and deletePad. … |
| Remediation | Vendor-released patch: upgrade to Etherpad 3.1.0, which corrects the claim check to require admin to be true rather than merely present (fix commit 8c6104c5d5daf41f0d454acc04d42dffa0e0d996 via PR https://github.com/ether/etherpad/pull/7784; advisory GHSA-qfmh-fph3-mw8q). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Etherpad instances running versions 2.1.0 through 3.0.x and apply the vendor-released patch immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary cod
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulne
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScri
Etherpad is a real-time collaborative editor. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to rea
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. Rated high severity (C
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. Rated high sev
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledg
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today