Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.3 · plausibleNVD modified 2026-10-30 11:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notification.ex#L21 technical-description
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controller.ex#L481-L494 technical-description
- https://abraxaslabs.tech/research/plausible-traffic-notify third-party-advisory
- https://github.com/plausible/analytics product
- https://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-mass-assignment-via-traffic-change-notification-update third-party-advisory