CVE-2026-25810 PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
Attackers can access or modify other students' submissions due to missing ownership checks in the PlaciPy placement management system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25810?
CVE-2026-25810 is a medium-severity missing authorization vulnerability in Praskla-Technology assessment-placipy, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
Weakness: CWE-862
Which versions are affected by CVE-2026-25810?
It affects 1 product.
Products include Prasklatechnology Placipy.
How do I fix CVE-2026-25810?
No fix has been published for CVE-2026-25810 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25810 being exploited?
There is no known exploitation of CVE-2026-25810 in the wild and no public exploit code.
Other vulnerabilities in Praskla-Technology assessment-placipy
- CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
- CVE-2026-25875 PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- CVE-2026-25753 PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
Sources
Also known as GHSA-2gqv-gxrj-p8x3.