An authorization bypass vulnerability in Etherpad allows authenticated non-admin users to perform sensitive administrative operations, including data deletion and modification.

This is an improper authorization vulnerability where the API handler checks only for the existence of an admin claim rather than its value. This allows an authenticated user with a valid OAuth token to invoke administrative functions, such as deleting pads or restoring revisions, despite not possessing the required administrative privileges.

This vulnerability allows for unauthorized data modification, disclosure, and deletion, which can lead to significant loss of intellectual property or sensitive collaborative documentation. Given the CVSS score of 9.9, the potential for widespread data destruction across an Etherpad instance is high, posing a major threat to organizational data integrity.

Immediate Action: Update the Etherpad installation to version 3.1.0 or later to resolve the authorization logic flaw.

Proactive Monitoring: Review application access logs for unexpected administrative API calls originating from non-administrative user accounts.

Compensating Controls: If immediate patching is not possible, restrict access to the API endpoints via network-level controls or authentication proxies that provide additional validation.

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB) available; exploit status is unknown.

This is a critical security vulnerability that directly impacts the integrity of collaborative data. Administrators should prioritize upgrading to Etherpad version 3.1.0 immediately to ensure that administrative functions are properly restricted to authorized personnel.