Plausible Analytics Community Edition versions up to 3.2.1 expose pending invitation and ownership‑transfer IDs on the settings/people page. An editor can view these identifiers, and an attacker who knows the invitee’s email address can use one of the exposed IDs to register a new account and accept the invitation. This grants the attacker the invited role or, if the ID pertains to an ownership transfer, full site ownership. The result is a change of ownership or role with no additional authentication beyond the email registration flow, effectively allowing a site takeover. This vulnerability is an instance of information exposure that escalates to unauthorized authority gain.

Plausible Analytics Community Edition, version 3.2.1.

The CVSS base score of 6 indicates a moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread evidence of exploitation yet. The attack vector is limited to the web UI where the invitation IDs are displayed; an attacker must first obtain an invitee’s email address and then register a new account with the exposed ID, implying the exploitation requires specific pre‑conditions but is feasible for anyone able to observe the settings page. The exploit path is straightforward once the conditions are met, but it does not allow arbitrary code execution or direct access to server resources. Overall, the risk is moderate with a realistic but constrained likelihood of exploitation.