Plainpad is a self‑hosted note‑taking application that, before version 1.1.1, allowed a normal authenticated user to elevate to administrator by sending admin=true in the PUT /api.php/v1/users/{id} request. The endpoint stores the supplied admin flag directly, granting the upgraded account immediate access to all admin‑only routes. This flaw corresponds to CWE-269 and results in a high‑severity privilege escalation that lets an attacker gain full control over the application and its data.

Plainpad, developed by alextselegidis, is affected in all releases prior to 1.1.1. The vulnerability was fixed in version 1.1.1.

The CVSS score of 8.3 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user session; once logged in, the attacker can trivially set the admin flag and immediately obtain administrative privileges with no further conditions.