What’s Vulnerable › Vulnerabilities
CVE-2026-25811: PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-09 · updated 2026-06-17
- Weakness: CWE-863
Description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
Affected products
References
Get alerted when CVE-2026-25811 or the next vulnerability affects your stack