CVE-2026-119565 Details

A mass assignment vulnerability has been identified in Plausible Analytics versions through 3.2.1. The issue resides in the 'update_traffic_change_notification' function, where authenticated site editors can manipulate notifications by introducing a 'site_id' parameter. Exploitation involves sending a 'traffic_change_notification[site_id]' value corresponding to another site's primary key via a PUT request to '/sites/:domain/traffic-change-notification/:type'. This allows the attacker to access the targeted site's traffic alerts and visitor statistics.

The vulnerability can be addressed by modifying the 'update_traffic_change_notification' function to prevent the 'site_id' parameter from being overwritten. Instead, the 'site_id' should be sourced from the session assigns, similar to the handling in other parts of the application.