{"id":"CVE-2026-119565","kind":"vulnerability","aliases":["CVE-2026-119565"],"related":[],"title":"Plausible Analytics: mass assignment lets editors reassign traffic alerts to other sites","description":"Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.","summary":"Plausible Analytics through 3.2.1 has a mass assignment flaw in its traffic change notification update, which lets a site editor move notifications to another site by supplying a site_id parameter. The attacker then receives another site's traffic alerts and visitor figures.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","plausible-analytics","self-hosted"],"not_affected_if":["auth-required","no-site-editors"],"how_to_check":"- Check the installed Plausible Analytics version and compare it with `3.2.1`.\n- Look for the route `PUT /sites/:domain/traffic-change-notification/:type` in your deployment's logs or code.","fix":null,"status":"open","published_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:55+00:00","updated_at":"2026-10-30T12:32:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Plausible Analytics: mass assignment lets editors reassign traffic alerts to other sites","impact":"low","summary":"Plausible Analytics through 3.2.1 has a mass assignment flaw in its traffic change notification update, which lets a site editor move notifications to another site by supplying a site_id parameter. The attacker then receives another site's traffic alerts and visitor figures.","audience":"businesses","category":"package","nicknames":[],"who_cares":["plausible-analytics","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"editor reads another site's traffic alerts and visitor figures","analyst_note":"Confirm the fixed version and whether a patch is available; the NVD entry in the sources does not state one.","how_to_check":"- Check the installed Plausible Analytics version and compare it with `3.2.1`.\n- Look for the route `PUT /sites/:domain/traffic-change-notification/:type` in your deployment's logs or code.","plain_action":"","needs_analyst":true,"not_affected_if":["no-site-editors","auth-required"],"who_is_affected":"Self-hosted or managed Plausible Analytics instances at version 3.2.1 or earlier where users hold the site editor role. The exposure is limited to authenticated editors who can reach the traffic change notification endpoint, so instances with only admin or viewer accounts are less exposed. unknown whether the sources list specific deployment modes beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4168,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119565':15A,18A '-2026':14A,17A '/sites':114C '3.2.1':29B,72C 'alert':9A,65B,123C 'allow':84C 'analyt':2A,22B,27B,70C 'anoth':49B,61B,107C 'assign':4A,33B,76C 'attack':58B,97C 'authent':85C 'chang':38B,81C,101C 'contain':73C 'cve':13A,16A 'domain/traffic-change-notification':115C 'editor':6A,45B,87C 'figur':68B,126C 'flaw':34B 'host':25B 'id':55B,95C,104C 'key':111C 'let':5A,42B 'mass':3A,32B,75C 'move':46B 'notif':39B,47B,82C,90C,102C 'packag':19B 'paramet':56B,96C 'plausibl':1A,21B,26B,69C 'plausible-analyt':20B 'primari':110C 'put':113C 'reassign':7A,89C 'receiv':60B,118C 'self':24B 'self-host':23B 'set':105C 'site':12A,44B,50B,54B,62B,86C,94C,103C,108C,120C 'submit':99C 'suppli':52B,92C 'traffic':8A,37B,64B,80C,100C,122C 'type':116C 'updat':40B,79C 'via':112C 'visitor':67B,125C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Plausible Analytics instances at version 3.2.1 or earlier where users hold the site editor role. The exposure is limited to authenticated editors who can reach the traffic change notification endpoint, so instances with only admin or viewer accounts are less exposed. unknown whether the sources list specific deployment modes beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119565","severity":null,"published_at":"2026-10-30T12:16:44+00:00","modified_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}