CVE-2026-55089: Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A configured non-admin OAuth user who can obtain a valid signed token through the authorization_code OAuth flow can exploit it. The issue affects Etherpad versions from 2.1.0 until 3.1.0.
Does an attacker need an administrator account or user interaction?
No. A non-admin OAuth account is sufficient because tokens issued to those users contain an admin: false claim, and the affected authorization check only verifies that the claim is present. No user interaction is required.
What access can a successful attacker gain?
The attacker can invoke every Etherpad HTTP API endpoint under /api/2/*, including functions to read pad and author information, modify pad contents, delete pads, copy or move pads, restore revisions, and anonymize authors. This can affect pads across the instance.
How is the issue remediated?
Upgrade to Etherpad 3.1.0, which fixes the authorization check. The provided information does not specify a workaround for installations that cannot be upgraded immediately.