CVE-2026-25811 PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
Attackers can access other tenants' data by spoofing email domains due to lack of domain ownership validation in PlaciPy.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25811?
CVE-2026-25811 is a medium-severity missing authorization vulnerability in Praskla-Technology assessment-placipy, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
Weakness: CWE-863
Which versions are affected by CVE-2026-25811?
It affects 1 product.
Products include Prasklatechnology Placipy.
How do I fix CVE-2026-25811?
No fix has been published for CVE-2026-25811 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25811 being exploited?
There is no known exploitation of CVE-2026-25811 in the wild and no public exploit code.
Other vulnerabilities in Praskla-Technology assessment-placipy
- CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
- CVE-2026-25875 PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- CVE-2026-25753 PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
Sources
Also known as GHSA-3gmm-9ww2-87fh.