Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119565Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

Medium 4.3

In plain English

A medium-severity security flaw in Plausible Analytics from Plausible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

Affected products (as reported)

Vendor	Product	Versions
Plausible	Plausible Analytics	0 – through 3.2.1

Weakness: CWE-915 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notification.ex#L21 technical-description
https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controller.ex#L481-L494 technical-description
https://abraxaslabs.tech/research/plausible-traffic-notify third-party-advisory
https://github.com/plausible/analytics product
VulnCheck Advisory: Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update third-party-advisory