CVE-2026-42562: Plainpad Privilege Escalation Vulnerability

CVE-2026-42562 Overview

Plainpad is a self-hosted note-taking application. Versions prior to 1.1.1 contain a privilege escalation flaw in the user update API. A low-privilege authenticated user can submit admin=true in a PUT /api.php/v1/users/{id} request and persist the attribute on their own account. The endpoint trusts client-supplied input and writes the admin field directly to the user record. The escalated account gains immediate access to administrator-only routes without re-authentication. The issue maps to CWE-269: Improper Privilege Management and is fixed in Plainpad 1.1.1.

Critical Impact
Any authenticated Plainpad user can elevate to administrator with a single API request, gaining full control over notes, users, and application settings.

Affected Products

Plainpad self-hosted note-taking application
All versions prior to 1.1.1
Fixed in Plainpad 1.1.1

Discovery Timeline

2026-05-09 - CVE-2026-42562 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42562

Vulnerability Analysis

The vulnerability is a mass-assignment privilege escalation in Plainpad's user update endpoint. The PUT /api.php/v1/users/{id} route accepts a JSON body describing user attributes and writes them directly to the user model. The handler does not filter sensitive fields such as admin from the request payload. As a result, a standard user editing their own profile can include admin: true and have it persisted. The application authorization layer subsequently grants full administrative access based on the stored attribute. Administrative routes then expose user management, configuration, and data across the instance.

Root Cause

The root cause is the absence of an attribute allowlist on the user update controller. Sensitive role fields are not separated from user-editable profile fields. The endpoint also lacks an authorization check that prevents non-administrators from modifying privilege attributes. This combination of missing input filtering and missing field-level authorization defines the CWE-269 condition.

Attack Vector

Exploitation requires only a valid low-privilege session and network access to the Plainpad API. The attacker sends an authenticated PUT request to their own user record with a JSON body containing "admin": true. The server persists the change and the session immediately resolves as administrative on subsequent requests. No user interaction, social engineering, or chained vulnerability is required.

For implementation specifics and the corrective code change, refer to the GitHub Security Advisory GHSA-pvfv-wvpm-q6f6 and the fix commit.

Detection Methods for CVE-2026-42562

Indicators of Compromise

PUT requests to /api.php/v1/users/{id} containing the field admin with value true in the JSON body.
Users whose admin flag changed without a corresponding action by an existing administrator.
Access to admin-only routes such as user management or settings endpoints by accounts that were previously standard users.

Detection Strategies

Inspect application and web server logs for PUT /api.php/v1/users/ requests issued by non-administrative session identifiers.
Compare the current administrator list against historical snapshots and flag any unexplained additions.
Alert on JSON request bodies to user endpoints that include privilege-related keys such as admin, role, or is_admin.

Monitoring Recommendations

Forward Plainpad access and audit logs to a centralized logging or SIEM platform for retention and correlation.
Track first-time administrator actions per user account and require manual review when a new admin is observed.
Monitor outbound activity from the Plainpad host for signs of post-escalation data exfiltration or persistence.

How to Mitigate CVE-2026-42562

Immediate Actions Required

Upgrade all Plainpad deployments to version 1.1.1 or later without delay.
Review the user table and remove administrator privileges from any account that was not explicitly authorized.
Rotate session secrets and force re-authentication of all users after patching.
Audit notes and configuration changes made during the exposure window for tampering.

Patch Information

The fix is shipped in Plainpad release 1.1.1. The corrective change is implemented in commit 9216a87, which removes the admin attribute from the fields accepted by the user update endpoint. Background and discussion are available in GitHub issue #138.

Workarounds

If patching is not immediately possible, restrict network access to the Plainpad API to trusted administrators only via firewall rules or a reverse proxy.
Place the /api.php/v1/users/ endpoint behind a web application firewall rule that rejects request bodies containing the admin field from non-administrative sessions.
Disable self-service account features and pause new user registration until the upgrade to 1.1.1 is completed.

bash

# Example reverse-proxy rule (NGINX) blocking admin field in user updates
location ~ ^/api\.php/v1/users/ {
    if ($request_method = PUT) {
        # Reject bodies containing the admin attribute at the proxy layer
        access_by_lua_block {
            ngx.req.read_body()
            local body = ngx.req.get_body_data() or ""
            if string.find(body, '"admin"%s*:%s*true') then
                ngx.exit(403)
            end
        }
    }
    proxy_pass http://plainpad_upstream;
}