CVE-2026-42562 Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)
Low-privilege users can escalate to administrator by modifying their profile, granting access to admin-only features.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42562?
CVE-2026-42562 is a high-severity vulnerability in alextselegidis plainpad, published on 9 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately access admin-only routes. This issue has been patched in version 1.1.1.
Weakness: CWE-269
Which versions are affected by CVE-2026-42562?
How do I fix CVE-2026-42562?
No fix has been published for CVE-2026-42562 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-42562 being exploited?
There is no known exploitation of CVE-2026-42562 in the wild and no public exploit code.
Sources
Also known as GHSA-pvfv-wvpm-q6f6.