Description

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T20:17:18.050Z",
  "pubdate": "2026-08-19T20:17:18.050Z",
  "executiveSummary": "An improper authorization vulnerability exists in Etherpad versions 2.1.0 through 3.1.0 within the APIHandler component handling requests to /api/2/* via the authorization_code OAuth path. The vulnerability arises because the authorization check in src/node/handler/APIHandler.ts only verifies the existence of the admin claim using requiredClaims, whereas src/node/security/OAuth2Provider.ts issues admin: false for non-admin users. Because the presence check evaluates to true even when the claim value is boolean false, any authenticated non-admin user possessing a validly signed OAuth2 token can successfully invoke administrative API endpoints. This enables unauthorized users to execute privileged actions such as modifying, disclosing, or deleting pads across the entire instance. The risk implication is severe, as it bypasses role-based access controls and compromises the confidentiality, integrity, and availability of all collaborative editing data. Exploitation requires the attacker to authenticate as a valid non-admin user to obtain a signed token and subsequently issue requests to restricted API routes. The issue is fully resolved in version 3.1.0.",
  "technicalDetails": "The root cause of this vulnerability lies in flawed claim validation logic within src/node/handler/APIHandler.ts when processing API requests targeting /api/2/* under the authorization_code OAuth workflow. Specifically, the authorization mechanism relies on the requiredClaims function to restrict access to administrative functions based on the presence of the admin claim. However, this validation check is implemented in a manner that only verifies whether the admin key exists within the claims dictionary of the token, rather than evaluating whether its associated boolean value evaluates to true. Concurrently, the OAuth2Provider.ts component properly assigns admin: false within the issued claims payload for configured non-admin users. Consequently, when a non-admin user authenticates and presents a validly signed OAuth2 token containing admin: false, the APIHandler.ts authorization check treats the mere existence of the admin key as sufficient proof of authorization. This bypasses the intended privilege boundary between administrator and standard user roles. The attack flow proceeds as follows: First, a standard, non-admin user authenticates against the Etherpad instance via the OAuth2 mechanism, obtaining a cryptographically signed token containing the admin: false claim. Second, the attacker issues HTTP requests to restricted administrative API endpoints located at /api/2/*. These vulnerable functions include setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad. Third, APIHandler.ts intercepts these requests, evaluates the token using the flawed requiredClaims logic, and grants execution access because the admin claim is present in the token payload. The vulnerable components are src/node/handler/APIHandler.ts and src/node/security/OAuth2Provider.ts, affecting Etherpad versions from 2.1.0 up to, but not including, 3.1.0. Exploitation requires network exposure to the Etherpad API, a valid low-privileged user account to generate a signed OAuth2 token, and the ability to send crafted API requests. Post-exploitation impact encompasses unauthorized data disclosure, arbitrary modification of pad contents, deletion of critical pads, metadata enumeration via listing operations, and compromise of author attribution across the affected instance."
}