Self-escalation Vulnerability in Plainpad Note Taking Application

CVE-2026-42562

What is CVE-2026-42562?

In the Plainpad note taking application, a vulnerability exists that allows a low-privilege authenticated user to escalate their privileges to that of an administrator. This occurs through the exploitation of the PUT /api.php/v1/users/{id} endpoint, where an attacker can submit 'admin=true' as input. The application incorrectly trusts this input and directly persists the admin attribute, granting the attacker immediate access to admin-only routes. This issue has been addressed in version 1.1.1, emphasizing the importance of not relying on user input for critical security attributes.

References