CVE-2026-25876 PlaciPy is Missing Authorization on Assessment Results Endpoint
Attackers can access all assessment results without ownership checks due to missing object-level authorization in PlaciPy.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25876?
CVE-2026-25876 is a medium-severity missing authorization vulnerability in Praskla-Technology assessment-placipy, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
Weakness: CWE-862
Which versions are affected by CVE-2026-25876?
It affects 1 product.
Products include Prasklatechnology Placipy.
How do I fix CVE-2026-25876?
No fix has been published for CVE-2026-25876 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25876 being exploited?
There is no known exploitation of CVE-2026-25876 in the wild and no public exploit code.
Other vulnerabilities in Praskla-Technology assessment-placipy
- CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
- CVE-2026-25875 PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- CVE-2026-25753 PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
Sources
Also known as GHSA-w238-w4mg-j357.