Executive brief
Plainpad, a self-hosted note-taking application, contains a security flaw that allows standard users to grant themselves administrative rights. By sending a specially crafted request during a profile update, any logged-in user can become an administrator. This allows an attacker to gain full control over the application, including access to all users' notes and administrative settings.
Technical details
A privilege escalation vulnerability exists in Plainpad's user update controller (server/app/Http/Controllers/V1/UsersController.php). The application fails to implement field-level authorization or mass-assignment protection on the 'admin' attribute within the PUT /api.php/v1/users/{id} endpoint. An authenticated attacker with low privileges can include 'admin=true' in their profile update request, which the server directly persists to the database. This grants the attacker immediate access to all administrative routes and capabilities. The issue is fixed in version 1.1.1 by restricting which attributes can be modified by non-admin users.
Affected products
- alextselegidis Plainpad < 1.1.1
Timeline
- 2026-04-22: disclosed: Issue reported to developer
- 2026-04-23: patched: Version 1.1.1 released
- 2026-05-09: advisory: CVE published