Plainpad CVE-2026-42562 Allows Low-Privilege Admin Escalation

The National Vulnerability Database has detailed CVE-2026-42562, a high-severity vulnerability (CVSS 8.3) impacting Plainpad, a self-hosted note-taking application. Prior to version 1.1.1, Plainpad allowed any authenticated user with low privileges to escalate their account to administrator status. This was possible by submitting admin=true via a PUT request to the /api.php/v1/users/{id} endpoint.

The core issue, categorized as CWE-269 (Improper Privilege Management), is that the endpoint directly persisted the admin attribute from user input without sufficient validation or authorization checks. Once escalated, the compromised account immediately gained access to all administrator-only routes and functionalities. This is a critical design flaw, as it allows attackers who gain initial access via phishing or weak credentials to quickly achieve full control over the Plainpad instance.

Plainpad has addressed this vulnerability in version 1.1.1. Organizations utilizing Plainpad instances are strongly advised to upgrade immediately. Failure to patch leaves the door wide open for any authenticated user to become an administrator, potentially leading to data manipulation, unauthorized access to sensitive notes, or further lateral movement within the compromised environment.