Live › vulnerability › CVE-2026-119565
Plausible Analytics through 3.2.1 has a mass assignment flaw in its traffic change notification update, which lets a site editor move notifications to another site by supplying a site_id parameter. The attacker then receives another site's traffic alerts and visitor figures.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted or managed Plausible Analytics instances at version 3.2.1 or earlier where users hold the site editor role. The exposure is limited to authenticated editors who can reach the traffic change notification endpoint, so instances with only admin or viewer accounts are less exposed. unknown whether the sources list specific deployment modes beyond this.
No product ranges from the sources yet.
3.2.1.PUT /sites/:domain/traffic-change-notification/:type in your deployment's logs or code.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
This page as .md · .json · in your agent: get_signal("CVE-2026-119565")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.