CVE-2026-119565

The record

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

Affected packages

Related vulnerabilities

• CVE-2026-114573 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-107249 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FTP Server… CWE-915
• CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. CWE-915
• CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. CWE-915
• CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared secret and… CWE-915
• CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
• CVE-2026-112295 FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows… CWE-915