CVE-2026-42562 - Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control)

CVE ID :CVE-2026-42562 Published : May 9, 2026, 8:16 p.m. | 48 minutes ago Description :Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}