Mass Assignment Vulnerability in Plausible Analytics Affects Site Editors

CVE-2026-119565

What is CVE-2026-119565?

Plausible Analytics version 3.2.1 has a mass assignment vulnerability in the update_traffic_change_notification function. This flaw allows authenticated site editors to manipulate the site_id parameter. By exploiting this vulnerability, attackers can send a malicious traffic_change_notification[site_id] via a PUT request, tricking the system into providing access to another site's traffic alerts and visitor data. This leads to unauthorized exposure of sensitive information and could severely compromise site integrity.

References