Plausible Analytics version 3.2.1 contains a mass assignment flaw in the update_traffic_change_notification handler that allows authenticated site editors to reassign traffic notifications by passing a site_id parameter. The attacker can set traffic_change_notification[site_id] to the primary key of another site via a PUT request to /sites/:domain/traffic-change-notification/:type, thereby receiving that site’s traffic alerts and visitor statistics. This flaw leads to inadvertent disclosure of visitor data from sites to which the attacker does not normally have access.

The vulnerability affects Plausible Analytics 3.2.1. All installations running this exact version are vulnerable; newer releases after 3.2.1 are not listed as affected.

The CVSS score of 5.3 classifies the issue as moderate severity. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, indicating limited or no known exploitation in the wild. The exploit requires the attacker to have authenticated editor privileges on a target site and to send a crafted PUT request; it is therefore limited to authenticated users with sufficient ACLs. While the risk of exploitation is moderate, the impact of leaking traffic data across tenants is significant for confidentiality. Potential attackers could use the disclosed data for traffic analysis, market intelligence, or competitive intelligence, which may compromise business operations or privacy expectations.