CVE-2025-62730 Privilege Escalation via Incorrect Authorization in SOPlanning

High 8.7 Published 20 Nov 2025 Updated 20 Nov 2025

Authenticated users with team management roles can escalate to admin privileges by modifying user permissions in SOPlanning.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-62730?

CVE-2025-62730 is a high-severity vulnerability in SOPlanning, published on 20 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges.

This issue was fixed in version 1.55.

Weakness: CWE-863

Which versions are affected by CVE-2025-62730?

It affects 1 product.

Products include Soplanning Soplanning.

How do I fix CVE-2025-62730?

No fix has been published for CVE-2025-62730 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-62730 being exploited?

There is no known exploitation of CVE-2025-62730 in the wild and no public exploit code.

Sources

Also known as GHSA-q58m-53vr-29p7.