CVE-2026-119564
Received Received - Intake

Information Exposure in Plausible Analytics Community Edition

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119564
EUVD
EUVD-2026-113829

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Plausible Plausible Analytics 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119564 is an information exposure vulnerability in Plausible Analytics Community Edition through version 3.2.1. It allows site editors to view pending invitation and ownership-transfer IDs from the settings/people page. Attackers can exploit this by registering with the invitee's email using the exposed ID and accepting the invitation, thereby gaining the invited role or taking ownership of the site.

Detection Guidance

Check the HTML source of the /settings/people page for exposed nanoid tokens in the HTML. Look for 21-character secret tokens in the page source that could be used for pending invitations or ownership transfers.

Impact Analysis

If you are a site owner or admin using Plausible Analytics Community Edition up to version 3.2.1, an attacker with editor access could take over your site by exploiting this vulnerability. This could lead to unauthorized access, data exposure, or loss of control over your analytics data and site settings.

Compliance Impact

This vulnerability could impact compliance with GDPR and other privacy regulations by allowing unauthorized access to sensitive site data. If an attacker gains control of a site, they may exfiltrate personal or analytics data, violating data protection requirements. Plausible Analytics emphasizes GDPR compliance, but this flaw undermines those efforts by enabling unauthorized access.

Mitigation Strategies

Upgrade Plausible Analytics to a version beyond 3.2.1 where the nanoid exposure issue is fixed. Ensure proper authorization checks are in place for pending transfers and restrict access to sensitive tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart