Description
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Plausible | Plausible Analytics | ≤ 3.2.1 | — |
References
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/templates/site/settings_people.html.heex#L136 technical-description
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/sites.ex#L189 technical-description
- https://abraxaslabs.tech/research/plausible-editor-invite third-party-advisory
- https://github.com/plausible/analytics product
- VulnCheck Advisory: Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs third-party-advisory