Plainpad versions before 1.1.1 suffer from improper privilege management (CWE-269) where the PUT /api.php/v1/users/{id} endpoint accepts an admin attribute from user input and persists it directly. This enables authenticated users with low privileges to escalate to administrator by setting admin=true in their request. The issue is resolved in version 1.1.1, which properly restricts privilege escalation through this endpoint.

An attacker with a low-privilege authenticated account can escalate to administrator privileges, gaining access to admin-only routes and potentially performing administrative actions. This compromises confidentiality and integrity of the application data and functionality. Availability impact is low. No known public exploits have been reported.

Upgrade Plainpad to version 1.1.1 or later, where this privilege escalation vulnerability has been patched. Since this is a self-hosted application, administrators should apply the update promptly to prevent unauthorized privilege escalation.