CVE-2026-55089 in Etherpad
Summary
by MITRE • 08/19/2026
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Etherpad versions ranging from 2.1.0 to 3.1.0 represents a critical authorization bypass within the OAuth2 authentication flow, specifically affecting endpoints under the /api/2/* path that utilize the authorization_code grant type. As a real-time collaborative editing platform, Etherpad relies on robust access control mechanisms to ensure data integrity and confidentiality among multiple users. The core technical flaw lies in the implementation of claim validation logic within src/node/handler/APIHandler.ts. When processing requests for administrative functions via OAuth2 tokens, the system employs requiredClaims that check exclusively for the existence of an admin claim rather than verifying its actual boolean value or scope. This design oversight creates a significant security gap because it fails to distinguish between users who are explicitly granted administrator privileges and those who possess standard user credentials.
The root cause is further exacerbated by the behavior defined in src/node/security/OAuth2Provider.ts, which correctly issues tokens with admin: false for configured non-administrative users. However, due to the lax validation logic in the API handler, a token containing an admin claim set to false or simply present without proper value verification is still accepted as valid for administrative operations. Consequently, any authenticated user who possesses a validly signed OAuth2 token can bypass privilege checks and invoke high-privilege endpoints. This includes sensitive functions such as setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad. The ability to execute these commands effectively grants the attacker full control over pad content and metadata regardless of their actual role within the application.
The operational impact of this vulnerability is severe, allowing for unauthorized disclosure, modification, or deletion of pads across the entire Etherpad instance. An attacker leveraging this flaw can read sensitive information stored in any pad by invoking listAllPads to discover available resources and then using text retrieval functions to extract content. Furthermore, they can disrupt service availability or integrity by deleting critical pads, overwriting important documents with malicious code via setHTML or setText, or moving and copying pads to obscure their actions or exfiltrate data indirectly through shared links. The anonymizeAuthor function adds another layer of risk by potentially stripping audit trails that would otherwise help in forensic analysis after an incident. This level of access undermines the fundamental trust model of a collaborative platform where users expect isolation between different project spaces and role-based restrictions on administrative controls.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves a failure to enforce proper authorization levels for an actor. It also maps closely to ATT&CK technique T1078 Valid Accounts, where the attacker utilizes legitimate credentials obtained through standard authentication processes but exploits flawed logic to escalate privileges beyond their intended scope. The specific mechanism of bypassing access control checks by manipulating claim validation is characteristic of CWE-285 Improper Authorization vulnerabilities often seen in complex web application frameworks that rely on external identity providers or token-based systems without rigorous server-side verification of all relevant attributes.
To mitigate this vulnerability, organizations running Etherpad must immediately upgrade to version 3.1.0 or later, where the issue has been resolved by correcting the claim validation logic to ensure that administrative privileges are strictly verified based on their actual values rather than mere existence. For environments unable to patch immediately due to dependency constraints, temporary mitigations should include restricting network access to Etherpad instances behind strict firewall rules and ensuring that only trusted internal networks can reach the API endpoints. Additionally, implementing Web Application Firewalls with specific rule sets to block unauthorized attempts at accessing administrative APIs using non-admin tokens can provide a layer of defense in depth. Regular auditing of OAuth2 token issuance policies and rigorous testing of role-based access controls during development cycles are essential practices to prevent similar privilege escalation flaws in future updates or custom integrations.