CVE-2026-55089 – Etherpad
“These flaws put pad data, administrative control, and trusted user sessions at risk.”
Etherpad fixes two Critical vulnerabilities. CVE-2026-55085 allows a user with pad write access to store malicious content that executes as cross-site scripting when another user, including an administrator, opens the pad or timeslider. It is fixed in version 3.3.1. CVE-2026-55085 has a CVSS score of 9.6, Critical severity.
CVE-2026-55089 allows a non-admin OAuth user with a valid signed token to invoke administrative API functions, enabling disclosure, modification, or deletion of pads across the instance. It is fixed in version 3.1.0. CVE-2026-55089 has a CVSS score of 9.9, Critical severity. Public proof-of-concept material is available for both vulnerabilities.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-863