CVE-2026-55089

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.

• CWE-863

• https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996
• https://github.com/ether/etherpad/pull/7784
• https://github.com/ether/etherpad/releases/tag/v3.1.0
• https://github.com/ether/etherpad/security/advisories/GHSA-qfmh-fph3-mw8q
• https://github.com/ether/etherpad/security/advisories/GHSA-qfmh-fph3-mw8q

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55082DHIS2 is a flexible information system for data capture, man…8.7
• CVE-2026-55084DHIS2 is a flexible information system for data capture, man…8.8
• CVE-2026-55085Etherpad is a real-time collaborative editor. Prior to 3.3.1…9.6
• CVE-2026-55086Etherpad is a real-time collaborative editor. Prior to 3.1.0…4.2
• CVE-2026-55087Etherpad is a real-time collaborative editor. From 2.1.0 unt…6.1
• CVE-2026-55088Etherpad is a real-time collaborative editor. From 2.6.0 unt…6.8
• CVE-2026-5509An authenticated command injection vulnerability exists in t…7.2
• CVE-2026-55090Etherpad is a real-time collaborative editor. Prior to 3.3.0…5.3
• CVE-2026-55091flat-to-nested converts a hierarchy from a flat representati…7.5
• CVE-2026-55092Trivy is a security scanner. Prior to 0.71.1, when Trivy dow…7.5
• CVE-2026-55093Tract is a tiny, no-nonsense, self-contained TensorFlow and …6.1
• CVE-2026-55095OpenProject is open-source, web-based project management sof…5.3