Get real-time updates on Telegram
CVE-2026-55089: etherpad >= 2.1.0, < 3.1.0
CVE-2026-55089. CVSS 3.1 base score 9.9 (CRITICAL, Vendor/CNA). EPSS 0.00464 (percentile 0.39263), scored 24-Oct-2026.
Affected technology
etherpad · >= 2.1.0, < 3.1.0
ether
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. Vendor/CNA’s CVSS 3.1 assessment (base score 9.9/10) rates confidentiality and integrity impact as high; availability impact as low.
- CWE
- CWE-863
- CCR priority
- 39.7 /100 (P4)
- CVSS 3.1
- 9.9 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L · Vendor/CNA
- EPSS
- 0.00464 · percentile 0.39263 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 16:36:51.698835+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-55089.html