Dashboard / CVE-2026-119564

CVE-2026-119564

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 52/100
Published: 2026-10-30 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: X
AT: Present
VC: None
VI: High
VA: None

Description

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Plausible Plausible Analytics 0
Plausible Plausible Analytics 0

References & Advisories (5)

Bug Bounty Relevance

52 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.29%
Raw Score 0.002920
Percentile 21.8%
Date 2026-11-02

EPSS Trend

2026-11-02
0.00292
2026-11-01
0.00292
2026-10-31
0.00292

Intelligence Sources

mitre ref →
nvd ref →

External Links