CVE-2026-42562

Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.

• CWE-269

• https://github.com/alextselegidis/plainpad/commit/9216a876d27b22c3d9259551636d803f7cb075fc
• https://github.com/alextselegidis/plainpad/issues/138
• https://github.com/alextselegidis/plainpad/releases/tag/1.1.1
• https://github.com/alextselegidis/plainpad/security/advisories/GHSA-pvfv-wvpm-q6f6

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42557jupyterlab is an extensible environment for interactive and …9.6
• CVE-2026-42558Xibo is an open source digital signage platform with a web c…7.6
• CVE-2026-42559RMCP is an official Rust SDK for the Model Context Protocol.…8.8
• CVE-2026-4256Improper neutralization of special elements used in an LDAP …8.2
• CVE-2026-42560auth provides authentication via oauth2, direct and email. F…9.1
• CVE-2026-42561Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-42563Dulwich is a pure-Python implementation of the Git file form…7.7
• CVE-2026-42564jotty·page is a self-hosted app for your checklists and note…8.2
• CVE-2026-42565@workos/authkit-session is a toolkit for building WorkOS Aut…4.3
• CVE-2026-42566Meshtastic is an open source mesh networking solution. Prior…7.5
• CVE-2026-42567Svelte is a performance oriented web framework. From version…7.5
• CVE-2026-42568Yamcs is a mission control framework. Prior to versions 5.13…4.3