{"id":"CVE-2026-119564","title":"Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs","summary":"Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register wit…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-201"],"vendor":"Plausible","product":"Plausible Analytics","affected":["analytics <= 3.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:21:09.644707Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:54:10.078Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119564","references":[{"url":"https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/templates/site/settings_people.html.heex#L136"},{"url":"https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/sites.ex#L189"},{"url":"https://abraxaslabs.tech/research/plausible-editor-invite"},{"url":"https://github.com/plausible/analytics"},{"url":"https://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-site-takeover-via-exposed-invitation-ids","label":"VulnCheck Advisory: Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs"}],"tags":["cve.org"],"epss":0.00292,"epssPercentile":0.21873,"ingestedAt":"2026-11-05T16:07:30.518Z","slug":"CVE-2026-119564","body":"## Overview\n\nPlausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.\n\n## Affected\n\n- `analytics <= 3.2.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}