CVE-2026-55089

Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.x

Description In the authorization code OAuth path, the src/node/handler/APIHandler.ts file incorrectly authorizes requests to the /api/2/* endpoint. The system checks for the existence of the admin claim but does not verify its value. Because src/node/security/OAuth2Provider.ts assigns admin: false to non-administrative users, any user with a valid signed token can execute administrative functions. These functions include setHTML(), setText(), appendText(), deletePad(), copyPad(), movePad(), restoreRevision(), anonymizeAuthor(), listAllPads(), and listAuthorsOfPad(), which may lead to the unauthorized disclosure, modification, or deletion of pads across the instance.

Recommendations Update to version 3.1.0.