# Plausible Analytics v3.2.1

- Product: Plausible Analytics (https://whatsnew.fyi/product/plausible)
- Vendor: Plausible
- Date: 2026-05-15
- Version: v3.2.1
- Original notes: https://github.com/plausible/analytics/releases/tag/v3.2.1
- Permalink: https://whatsnew.fyi/product/plausible/releases/v3.2.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Remove HTTP "/storybook" endpoint that allowed remote code execution under certain conditions

#### Security related update

This patch release **fixes a security vulnerability**[`CVE-2026-8467` / `GHSA-55hg-8qxv-qj4p`](https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p) affecting the following versions of Plausible Community Edition (image: ghcr.io/plausible/community-edition):
Tags:
- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

The affected versions expose a `HTTP "/storybook"` endpoint which, under certain conditions, allows remote code execution with privileges of system user running the application.

This release v3.2.1 of Plausible Community Edition completely removes that endpoint.

##### Who is affected?

All deployments of Plausible Community Edition running the following versions:

- v3.2
- v3.2.0
- v3
- v3.2.0-rc.0
- v3.1
- v3.1.0
- v3.1.0-rc.1
- v3.1.0-rc.0
- v3.0.1
- v3.0
- v3.0.0
- v3.0.0-rc.6
- v3.0.0-rc.5
- v3.0.0-rc.4
- v3.0.0-rc.3
- v3.0.0-rc.2
- v3.0.0-rc.1
- v3.0.0-rc.0

where `HTTP "/storybook"` endpoint is exposed to a public or other untrusted network.

##### Mitigation

All affected versions of Plausible Community Edition should be updated to v3.2.1 as soon as possible.

As an immediate mitigation, it is recommended to block access to HTTP "/storybook" endpoint in your reverse proxy configuration or via other applicable means.

##### Changes in this release

- Remove `HTTP "/storybook"` endpoint along with the associated logic

No other changes are included in this release.