Plausible Analytics up to 3.2.1 Traffic Change Notification traffic_change_notification.ex update_traffic_change_notification site_id dynamically-determined object attributes

Summaryinfo

A vulnerability was found in Plausible Analytics up to 3.2.1. It has been rated as critical. This issue affects the function update_traffic_change_notification of the file lib/plausible/site/traffic_change_notification.ex of the component Traffic Change Notification. This manipulation of the argument site_id causes dynamically-determined object attributes. This vulnerability is tracked as CVE-2026-119565. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Plausible Analytics up to 3.2.1. It has been declared as critical. Affected by this vulnerability is the function update_traffic_change_notification of the file lib/plausible/site/traffic_change_notification.ex of the component Traffic Change Notification. The manipulation of the argument site_id with an unknown input leads to a dynamically-determined object attributes vulnerability. The CWE definition for the vulnerability is CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-119565 since 10/30/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/30/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Plausible

Name

• Analytics

Version

• 3.2.0
• 3.2.1

Website

• Product: https://github.com/plausible/analytics/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion