Etherpad's authorization mechanism for the /api/2/* endpoints in the OAuth authorization_code flow incorrectly validates the admin claim by only checking for its existence rather than its value. Non-admin users receive tokens with admin: false, but the authorization check only requires the presence of the admin claim, enabling these users to invoke administrative API functions such as setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad. This leads to unauthorized administrative access allowing disclosure, modification, or deletion of collaborative pads. The vulnerability affects Etherpad versions from 2.1.0 until fixed in 3.1.0.

An attacker with a valid signed token but non-admin privileges can exploit this vulnerability to perform administrative actions on Etherpad, including reading, modifying, deleting, copying, moving pads, restoring revisions, anonymizing authors, and listing all pads and authors. This results in a complete compromise of data confidentiality, integrity, and partial availability within the Etherpad instance.

This vulnerability is fixed in Etherpad version 3.1.0. Users should upgrade to version 3.1.0 or later to remediate this issue. No official patch or temporary workaround is indicated in the available data. Until upgrading, restrict access to tokens and monitor for unauthorized administrative actions.