CVE-2026-55089 ether CVE debrief

Who should care

Defenders responsible for Etherpad instances, particularly those using versions between 2.1.0 and 3.1.0, should assess exposure and prioritize patching. They should also verify user permissions, monitor for suspicious activity, and review compensating controls for exposed systems. Additionally, defenders should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets.

Why it matters

CVE-2026-55089 is a critical vulnerability in Etherpad that allows non-admin users to invoke administrative functions, potentially leading to disclosure, modification, or deletion of pads. Defenders should prioritize patching to version 3.1.0 or later, verify user permissions, and monitor for suspicious activity. The vulnerability requires verification of user permissions and access controls, and its impact is limited to Etherpad instances using versions between 2.1.0 and 3.1.0.

• Potential disclosure of sensitive pad content
• Possible modification or deletion of pads by non-admin users
• Bypass of access controls for administrative functions
• Verification of user permissions and access controls is required

Technical summary

The vulnerability in Etherpad allows non-admin users with valid signed tokens to invoke administrative functions, potentially leading to disclosure, modification, or deletion of pads across the instance. This issue arises from the authorization_code OAuth path in src/node/handler/APIHandler.ts requiring only the existence of the admin claim, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. The vulnerability is fixed in version 3.1.0 and requires verification of user permissions and access controls.

Defensive priority

Defenders should prioritize patching to version 3.1.0 or later, verify user permissions, and monitor for suspicious activity.

Recommended defensive actions

• Patch to version 3.1.0 or later
• Verify user permissions and access controls
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The vulnerability allows non-admin users with valid signed tokens to invoke administrative functions, potentially leading to disclosure, modification, or deletion of pads across the instance. Defenders should verify user permissions and access controls, and monitor for suspicious activity. The issue is fixed in version 3.1.0. Evidence limits suggest that additional details may exist but are not verified. Further verification is in

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.