CVE-2026-55089

{
  "id": "CVE-2026-55089",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T20:17:18.050",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0."
    },
    {
      "lang": "es",
      "value": "Etherpad es un editor colaborativo en tiempo real. Desde la versión 2.1.0 hasta la 3.1.0, src/node/gestor/APIHandler.ts de Etherpad autoriza solicitudes a /api/2/* en la ruta OAuth de authorization_code mediante el uso de requiredClaims con la declaración admin. Esta verificación solo requiere que la declaración exista, mientras que src/node/security/OAuth2Provider.ts emite admin: false para usuarios no administradores configurados. Un usuario no administrador con un token firmado válido puede, por lo tanto, invocar funciones administrativas, incluyendo setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads y listAuthorsOfPad, permitiendo la divulgación, modificación o eliminación de pads en toda la instancia. Este problema está solucionado en la versión 3.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ether",
          "product": "etherpad",
          "versions": [
            {
              "version": ">= 2.1.0, < 3.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T19:48:52.330922Z",
          "id": "CVE-2026-55089",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ether/etherpad/pull/7784",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ether/etherpad/releases/tag/v3.1.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ether/etherpad/security/advisories/GHSA-qfmh-fph3-mw8q",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ether/etherpad/security/advisories/GHSA-qfmh-fph3-mw8q",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}