CVE-2026-42562 Details

A privilege escalation vulnerability has been identified in Plainpad, a self-hosted note-taking application, prior to version 1.1.1. The issue allows low-privilege authenticated users to escalate their privileges to admin by sending a request with 'admin=true' to the 'PUT /api.php/v1/users/{id}' endpoint. This endpoint improperly validates user input, directly applying the 'admin' attribute without appropriate authorization checks. Once escalated, users can access admin-only routes immediately.

Users are advised to update to Plainpad version 1.1.1, where this vulnerability has been patched.