Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119565— Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Quick assessment

Affected
Plausible Plausible Analytics
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Plausible Analytics 3.2.1 及更早版本在 函数中存在批量赋值漏洞。该漏洞允许已认证的网站编辑通过提供 参数来重新分配通知。攻击者可通过向 接口发送请求，将 设置为其他网站的主键，从而获取该网站的流量警报和访客数据。

CVSS 4.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
Plausible Plausible Analytics ≤ 3.2.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119565

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Source: CVE Program / CVE List V5
Vulnerability Description
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Plausible Plausible Analytics 0 ~ 3.2.1 -

II. Public POCs for CVE-2026-119565

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119565

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119565 (1)

Proof of Concept for CVE-2026-119565 (1)

Security Blog Posts for CVE-2026-119565 (1)

Vendor Pages for CVE-2026-119565 (1)

Other References for CVE-2026-119565 (1)

IV. Related Vulnerabilities

Same product: Plausible Analytics
Same vendor: Plausible
Same weakness: CWE-915