CVE-2026-55089
CriticalCVSS 9.9Summary
Etherpad from version 2.1.0 to 3.1.0 contains an authorization vulnerability in the API that allows a non-admin user with a valid token to invoke administrative functions such as modifying, deleting, or disclosing pads.
Risk Assessment
Unauthorized access to administrative functions could lead to confidentiality, integrity, and availability breaches across the entire Etherpad instance.
Recommendation
Upgrade Etherpad to version 3.1.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.