Plausible Analytics EUVD-2026-113830

Exploitation requires an authenticated account with site-editor privileges on the target Plausible Analytics instance (PR:L), and the instance must host multiple sites so that another site's primary key exists to target. The attacker sends PUT /sites/:domain/traffic-change-notification/:type with the parameter traffic_change_notification[site_id] set to the victim site's primary key; the update_traffic_change_notification handler mass-assigns this field instead of restricting it to the editor's own site. Limiting factors: the attacker must already have a valid editor-level account and must know or enumerate the victim's internal site_id; impact is limited to read access to traffic-change alerts and visitor figures, with no integrity or availability impact and no cross-system (scope) escalation.

This is a genuine but moderate-severity cross-tenant information disclosure, not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score are internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring an authenticated account (PR:L) with site-editor privileges, and yielding only limited confidentiality impact (VC:L) with no integrity or availability impact. The vuln.today priority is 'this_month', not 'act_now' or 'emergency', which aligns with the medium severity. No EPSS score was provided, so statistical exploitation probability cannot be stated. The CVE is not listed in CISA KEV, so there is no confirmed active exploitation. A public research write-up (abraxaslabs.tech) and a VulnCheck advisory are referenced, so a public PoC reference exists, though it is not verified as working exploit code in the input. The authentication barrier (a valid site-editor account on the same instance) and the limited impact (read-only access to another site's traffic alerts and visitor figures, no write or takeover) keep real-world risk contained; it is a legitimate privacy/multi-tenant isolation defect worth patching in the normal cycle rather than a drop-everything priority.

An attacker who holds a legitimate site-editor account on a shared Plausible Analytics instance (for example a SaaS tenant or a multi-user self-hosted deployment) sends a PUT request to /sites/:domain/traffic-change-notification/:type with traffic_change_notification[site_id] set to the primary key of a site they do not own. The mass-assignment flaw binds the attacker-supplied site_id, reassigning that victim site's traffic-change notifications to the attacker, who then receives the victim's traffic alerts and visitor figures. A public PoC reference exists but is not verified as working exploit code.