EUVD lists Plausible Analytics information exposure flaw (EUVD-2026-113829)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Plausible
- Product
- Plausible Analytics Community Edition
- First seen
Summary
The EU Vulnerability Database (EUVD) lists an information exposure vulnerability in Plausible Analytics Community Edition through 3.2.1, scored 6.0/10 under CVSS v3.1. According to the listing, site editors can obtain pending invitation and ownership-transfer IDs from the settings/people page.
If you use Plausible
Check whether any instance runs Plausible Analytics Community Edition 3.2.1 or earlier
Upgrade to a release that the vendor marks as fixed
Review pending invitations and ownership transfers for unexpected entries
Check whether any instance runs Plausible Analytics 3.2.1 or earlier
Review traffic change notification settings for unexpected changes
What the sources say 2
· Mastodon: “Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter.” Source
· Mastodon: “Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page.” Source