Threats affecting pkg:github/plausible/analytics

Plausible Analytics versions up to 3.2.1 have a mass assignment vulnerability in the update_traffic_change_notification function. Authenticated site editors can exploit this flaw by supplying a site_id parameter to reassign traffic change notifications to another site. This allows them to receive traffic alerts and visitor data for sites they do not own or manage.

Plausible Analytics Community Edition versions through 3.2.1 have an information exposure vulnerability that allows site editors to view pending invitation and ownership-transfer IDs. An attacker who obtains these IDs can register using the invitee's email and accept the invitation, thereby gaining the invited role or taking ownership of the site.