CVE-2026-119565: Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in updatetrafficchangenotification that allows authenticated site editors to reassign notifications by supplying a siteid parameter. Attackers can submit trafficchangenotification[siteid] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with site editor privileges can exploit it. The attacker must be able to send a PUT request to the traffic-change-notification update endpoint.
What information can an attacker obtain?
The attacker can reassign a traffic-change notification to another site's primary key, causing alerts for that site to be delivered to the attacker. Those alerts can expose the other site's visitor figures.
Is this exploitable without authentication?
No. The described attack requires an authenticated site editor, so unauthenticated users are not described as able to exploit it.
How can I check whether my instance may be affected?
Review traffic-change-notification update requests for a supplied traffic_change_notification[site_id] value that differs from the site associated with the requested domain. Also inspect notification assignments for site IDs that do not match their intended site.