CVE-2026-55089

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55089
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55089.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55089
Aliases
  • GHSA-qfmh-fph3-mw8q
Published
2026-08-19T19:33:19.806Z
Modified
2026-08-21T03:46:50.224305469Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
Details

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55089.json"
}
References

Affected packages

Git / github.com/ether/etherpad

Affected ranges

Type
GIT
Repo
https://github.com/ether/etherpad
Events
Introduced
c45b7a361e56e6c753cd1c9b8cc4e1017090ce9c
Fixed
8c6104c5d5daf41f0d454acc04d42dffa0e0d996
Fixed
fa1c6b2e43d0510c851643cb7ba67cf042331a37
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "3.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.3
2.6.0
2.6.1
2.7.0
2.7.1
2.7.2
2.7.3
3.*
3.0.0
v2.*
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.3
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55089.json"