CVE-2026-55089: Etherpad Auth Bypass Vulnerability

CVE-2026-55089 Overview

CVE-2026-55089 is an authorization bypass vulnerability in Etherpad, the real-time collaborative editor. Versions from 2.1.0 up to but not including 3.1.0 authorize requests to /api/2/* in the authorization_code OAuth2 path by checking that the admin claim exists, rather than verifying its value. Because src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users, any authenticated non-admin user with a valid signed token can invoke administrative API functions. The flaw is tracked under CWE-863: Incorrect Authorization and is fixed in Etherpad 3.1.0.

Critical Impact
Non-admin OAuth2 users can invoke administrative API functions including setHTML, deletePad, copyPad, movePad, and listAllPads, enabling disclosure, modification, or deletion of every pad on the instance.

Affected Products

Etherpad versions 2.1.0 through 3.0.x (inclusive)
Instances configured with the OAuth2 authorization_code flow
Deployments exposing /api/2/* endpoints to authenticated non-admin users

Discovery Timeline

2026-08-19 - CVE-2026-55089 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55089

Vulnerability Analysis

The defect resides in src/node/handler/APIHandler.ts. The handler protects the /api/2/* administrative surface using a requiredClaims array containing the string admin. The verification logic treats presence of the claim as sufficient authorization. However, src/node/security/OAuth2Provider.ts emits the admin claim on every signed token, setting it to true for administrators and false for standard users. The token consumer never inspects the boolean value.

The result is a complete separation between authentication and authorization decisions. Any non-admin user who can complete the OAuth2 authorization code flow obtains a signed token that satisfies the presence check. That token unlocks pad-management routines that were intended for administrator use only.

Root Cause

The root cause is a claim-existence check applied where a claim-value check is required. requiredClaims: ['admin'] matches tokens where the claim is present regardless of value. The provider's decision to emit admin: false rather than omit the claim for non-admins is what makes the mismatch exploitable.

Attack Vector

An attacker with valid non-admin credentials on the target Etherpad instance completes the OAuth2 authorization_code flow and receives a signed JWT. The attacker then issues HTTP requests to /api/2/<function> with that bearer token. Administrative functions exposed include setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad. The attacker can enumerate every pad on the instance, exfiltrate contents, overwrite documents, or destroy them.

typescript

// Patch excerpt from src/node/handler/APIHandler.ts
// harden: assorted server-side tightening for 3.0.2 (#7784)

import {MapArrayType} from "../types/MapType";
-import { jwtDecode } from "jwt-decode";
const api = require('../db/API');
const padManager = require('../db/PadManager');
import settings from '../utils/Settings';

Source: GitHub Commit 8c6104c5

The commit removes the client-side jwt-decode usage and tightens server-side validation of the token payload, so that the admin claim's boolean value governs access rather than its mere presence.

Detection Methods for CVE-2026-55089

Indicators of Compromise

HTTP requests to /api/2/listAllPads, /api/2/deletePad, /api/2/copyPad, or /api/2/movePad originating from OAuth2 tokens tied to non-admin user identifiers.
Unexpected calls to setHTML, setText, or appendText against pads the requesting user does not own.
Bearer tokens whose decoded payload contains "admin": false reaching administrative API routes.
Sudden bulk enumeration of pads followed by restoreRevision or anonymizeAuthor calls.

Detection Strategies

Parse Etherpad access logs and correlate /api/2/* request paths with the sub and admin fields of the presenting JWT.
Alert when the same OAuth2 client issues requests to more than one administrative API function within a short window.
Diff the pad inventory returned by listAllPads against expected baselines to identify unauthorized creation or deletion.

Monitoring Recommendations

Forward Etherpad application logs and reverse proxy logs to a centralized analytics platform for retention and query.
Monitor OAuth2 provider logs for token issuance patterns where non-admin identities immediately access administrative endpoints.
Track pad revision counts and deletions per hour; deviations from baseline indicate abuse of restoreRevision or deletePad.

How to Mitigate CVE-2026-55089

Immediate Actions Required

Upgrade Etherpad to version 3.1.0 or later on every instance that accepts OAuth2 authentication.
Rotate OAuth2 signing keys and revoke outstanding tokens after upgrading to invalidate any tokens minted during the exposure window.
Audit listAllPads output and pad revision history for unauthorized additions, deletions, or content changes.

Patch Information

The fix ships in Etherpad 3.1.0. Review the GitHub Security Advisory GHSA-qfmh-fph3-mw8q, the Pull Request #7784, and the v3.1.0 Release Notes. The corrective commit is 8c6104c5d5daf41f0d454acc04d42dffa0e0d996, which tightens server-side token validation.

Workarounds

Disable the OAuth2 authorization_code flow until the instance is upgraded to 3.1.0.
Restrict /api/2/* administrative routes at the reverse proxy layer to allow only source addresses associated with administrator workstations.
Limit OAuth2 client registration to trusted administrator accounts only, reducing the population of tokens that can reach the vulnerable check.

bash

# Example nginx restriction for /api/2/* until patched
location /api/2/ {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://etherpad_upstream;
}