Live › vulnerability › CVE-2026-119564
Plausible Analytics Community Edition through 3.2.1 shows pending invitation and ownership-transfer IDs on the settings/people page to site editors. A site editor can use an exposed ID to register with the invitee's email and accept it, gaining the invited role or taking site ownership.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that self-host Plausible Analytics Community Edition at version 3.2.1 or earlier and give site editors access to the settings/people page are exposed. Instances where only trusted admins have editor access, or that use managed hosting, have a smaller exposure; the sources do not say which hosted offerings are affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
This page as .md · .json · in your agent: get_signal("CVE-2026-119564")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.