etherpad: vulnerabilities fixed Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.9, CVEs: CVE-2026-55089, CVE-2026-55085, Summary: CVE-2026-55089 9.9 Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint CVE-2026-55085 9.6 Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite See also: https://github.com/ether/etherpad/security/advisories/GHSA-f7h5-v9hm-548j CVSS 9.9 CVE-2026-55085 CVE-2026-55089 Etherpad FI NCSC-FI · 20. 8. 04:00