CVE-2026-119565: falha de média gravidade em Plausible Analytics
Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Plausible · Plausible AnalyticsCVEs relacionadas — Plausible Analytics
No mesmo produto, das mais perigosas para as menos.
Referências
https://abraxaslabs.tech/research/plausible-traffic-notifyhttps://github.com/plausible/analyticshttps://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notification.ex#L21https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controller.ex#L481-L494https://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-mass-assignment-via-traffic-change-notification-update