CVE-2026-119565 in Analytics
Summary
by MITRE • 10/30/2026
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Plausible Analytics versions through 3.2.1 represents a critical mass assignment flaw within the update_traffic_change_notification endpoint, specifically affecting authenticated users with editor privileges on any given site. This security defect arises from improper validation of input parameters during the processing of HTTP PUT requests directed at /sites/:domain/traffic-change-notification/:type. The application fails to enforce strict object permission checks or parameter filtering when accepting data for traffic change notifications, thereby allowing an attacker to manipulate internal state by supplying a maliciously crafted site_id parameter within the request body.
From a technical perspective, this is a classic instance of insecure direct object references combined with mass assignment vulnerabilities as defined in CWE-284 and CWE-915 respectively. The application logic assumes that any authenticated editor can only interact with resources associated with their own domain due to implicit trust or insufficient server-side validation. However, by explicitly providing the site_id field set to the primary key of a different organization's site within the traffic_change_notification payload, an attacker bypasses these implicit boundaries. This allows the system to associate notification settings intended for one tenant with another, effectively reassigning ownership of those notifications without proper authorization checks.
The operational impact of this vulnerability is significant in terms of confidentiality and potentially integrity depending on downstream usage of the data. An authenticated site editor can exploit this flaw to receive traffic alerts and visitor figures belonging to other sites hosted on the same Plausible Analytics instance. This constitutes a severe breach of multi-tenant isolation, leading to unauthorized access to sensitive business intelligence such as user counts, page views, and referral sources for competitors or unrelated organizations sharing the platform. The attacker does not need administrative privileges; standard editor rights are sufficient to execute this attack vector, lowering the barrier for exploitation significantly.
This behavior aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials and roles to perform unauthorized actions within a multi-tenant SaaS environment. It also reflects aspects of T1530, Data from Cloud Storage Object, since the attacker is accessing data objects belonging to other tenants via API manipulation rather than direct storage access. The ability to intercept traffic notifications means that sensitive metrics are exposed across organizational boundaries, violating privacy expectations and potentially exposing proprietary performance indicators to unauthorized parties.
Mitigation strategies must focus on enforcing strict authorization checks at the application logic level immediately upon receipt of the request parameters. Developers should implement explicit validation ensuring that the site_id provided in the notification payload matches the domain or tenant context associated with the authenticated user's session permissions. Additionally, implementing parameterized queries and whitelisting allowed fields for mass assignment operations will prevent unintended property overwrites. Upgrading to a patched version where this logic has been corrected is essential, alongside reviewing API endpoints for similar patterns of insufficient input validation across other notification or configuration services within the platform.