CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
11th
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.
| CWE | CWE-269 |
| Vendor | alextselegidis |
| Product | plainpad |
| Published | May 9, 2026 |
| Last Updated | May 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for alextselegidis plainpad
Be the first to know when new high vulnerabilities affecting alextselegidis plainpad are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
alextselegidis / plainpad
< 1.1.1
References
github.com: https://github.com/alextselegidis/plainpad/security/advisories/GHSA-pvfv-wvpm-q6f6 github.com: https://github.com/alextselegidis/plainpad/issues/138 github.com: https://github.com/alextselegidis/plainpad/commit/9216a876d27b22c3d9259551636d803f7cb075fc github.com: https://github.com/alextselegidis/plainpad/releases/tag/1.1.1