What’s Vulnerable › Vulnerabilities

CVE-2026-25806: PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-09 · updated 2026-06-17
• Weakness: CWE-862

Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.

Affected products

• Praskla-Technology assessment-placipy: 1.0.0

References

• https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj

Get alerted when CVE-2026-25806 or the next vulnerability affects your stack