etherpad vulnerabilities

2 known vulnerabilities in etherpad from Ether. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  etherpad: Incorrect Authorization

  CVE-2026-55089Aug 19, 2026Ether

  Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the

• 9.6 Critical severity

  etherpad: Improper Neutralization of Input During Web Page Generation

  CVE-2026-55085Aug 19, 2026Ether

  Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML