Etherpad versions 2.1.0 through 3.1.0 contain an authorization flaw that checks only for the presence of the JWT "admin" claim instead of verifying that the claim is set to true. A non‑admin OAuth user possessing a valid signed token can thus call any /api/2/* endpoint and perform administrative actions such as setting pad content, deleting pads, copying pads, restoring revisions, anonymizing authors, and enumerating all pads. This represents a critical escalation of privilege allowing a non‑admin user to gain full administrative control, breach confidentiality, alter data, and arbitrarily delete content. The weakness aligns with CWE‑863, Definition of Confusing Definition or Abuse of Authenticated Privileges.

The vulnerability affects Etherpad installations produced by the vendor ether:@etherpad. All releases from version 2.1.0 up to and including 3.0.x are impacted. The issue is resolved starting with Etherpad v3.1.0, which implements proper admin claim validation.

The vulnerability carries a CVSS score of 9.9, indicating a highly severe security issue. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is remotely exploitable via an OAuth token; any attacker who can obtain a valid signed JWT for a non‑admin user can trigger the privileged API calls, making this a serious threat for any Etherpad instance exposing its OAuth endpoints.