CVE-2026-119565

24th percentile - higher than 24% of all known CVEs

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

A site editor can capture notifications and visitor data belonging to another site, breaching confidentiality. This can lead to leakage of traffic and user information of other sites.

Update Plausible Analytics to a version later than 3.2.1. Until patched, restrict site editor permissions and monitor for unusual notification changes.