Vulnerability in Plausible Analytics

[ Description ]Official description

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• abraxaslabs.tech/research/plausible-traffic-notify
• github.com/plausible/analytics
• github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notificati…
• github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controlle…
• www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-mass-assignment-via-traf…