Information Exposure in Plausible Analytics Community Edition by Plausible
CVE-2026-119564

6MEDIUM

Key Information:

Vendor

Plausible

Status
Plausible Analytics
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119564?

Plausible Analytics Community Edition up to version 3.2.1 is susceptible to an information exposure vulnerability, where site editors can access pending invitation and ownership-transfer IDs through the settings/people page. This flaw permits potential attackers to register using the invitee's email paired with the exposed ID, subsequently allowing them to accept the invitation, thereby acquiring the role of the invited user or taking control of the site.

Affected Version(s)

Plausible Analytics 0 <= 3.2.1

References

https://github.com/plausible/analytics/blob/v3.2.1/lib/pl...
technical-description
https://github.com/plausible/analytics/blob/v3.2.1/lib/pl...
technical-description
https://abraxaslabs.tech/research/plausible-editor-invite
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.