CVE-2026-55089: critical vulnerability in etherpad
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.5%
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
ether · etherpadRelated CVEs — etherpad
In the same product, most dangerous first.
CVE-2026-55087MEDIUMEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)EPSS 0.6%CVE-2026-55090MEDIUMEtherpad: Stored XSS in HTML export via unescaped attribute-pool valuesEPSS 0.5%CVE-2026-55085CRITICALEtherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteEPSS 0.5%CVE-2026-55088MEDIUMEtherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author tokenEPSS 0.4%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.1%