Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Etherpad: Non-admin users can access admin features

CVE-2026-55089 · published 15 days ago
Summary

Etherpad's authorization system had a bug that allowed non-admin users to access sensitive features. This bug was fixed in version 3.1.0. If you're using an earlier version of Etherpad, we recommend updating to the latest version to ensure the security of your collaborative editor.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ether etherpad >= 2.1.0, < 3.1.0
Original advisory text
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
CVSS 3.1: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-863Incorrect Authorization
Timeline
Published19 Aug 2026
Updated3 Sep 2026
First seen19 Aug 2026
Sources
CVE-2026-55089 · OSV
CVE-2026-55089 · NVD
CVE-2026-55089 · MITRE
GHSA-qfmh-fph3-mw8q · GHSA
Monitor software like this
Free during beta