CVE-2026-42562 is a privilege escalation vulnerability in the self-hosted note-taking app Plainpad (versions before 1.1.1). The vulnerability arises because the PUT /api.php/v1/users/{id} endpoint directly persists the 'admin' attribute from user input without proper authorization checks. As a result, a low-privilege authenticated user can escalate to administrator by setting admin=true in the request payload. This allows immediate access to admin-only routes. The vulnerability is classified under CWE-269 (Improper Privilege Management) and has a CVSS 3.1 base score of 8.3 (high severity). The issue has been patched in Plainpad version 1.1.1.

Exploitation of this vulnerability allows a low-privilege authenticated user to gain administrator privileges within the Plainpad application. This leads to unauthorized access to administrative functions, potentially compromising confidentiality and integrity of data, and limited availability impact. There are no known exploits in the wild at this time.

Upgrade Plainpad to version 1.1.1 or later, where this privilege escalation vulnerability has been patched. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional mitigations are indicated.