v3.2.1

BenedictKing/ccxv3.2.1May 15, 2026by cnkk

AI Summary

This is a critical security patch release that addresses CVE-2026-8467 by removing the exposed `/storybook` HTTP endpoint, which previously allowed remote code execution. It serves as an immediate mandatory update for all affected versions.

Key Highlights

Removes `/storybook` endpoint to fix RCE vulnerability (CVE-2026-8467)
Mandatory update for all affected versions
No other functional changes included in this release

Breaking Changes

Removal of the `/storybook` HTTP endpoint

New Features

Security hardening (endpoint removal)

Full Release Notes

# Security related update

This patch release **fixes a security vulnerability**[`CVE-2026-8467` / `GHSA-55hg-8qxv-qj4p`](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p) affecting the following versions of Plausible Community Edition (image: ghcr.io/plausible/community-edition):
Tags:
- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

The affected versions expose a `HTTP "/storybook"` endpoint which, under certain conditions, allows remote code execution with privileges of system user running the application.

This release v3.2.1 of Plausible Community Edition completely removes that endpoint.

## Who is affected?

All deployments of Plausible Community Edition running the following versions:

- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

where `HTTP "/storybook"` endpoint is exposed to a public or other untrusted network.

## Mitigation

All affected versions of Plausible Community Edition should be updated to v3.2.1 as soon as possible.

As an immediate mitigation, it is recommended to block access to HTTP "/storybook" endpoint in your reverse proxy configuration or via other applicable means.

## Changes in this release

- Remove `HTTP "/storybook"` endpoint along with the associated logic

No other changes are included in this release.