CVE-2026-25806

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25806
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:prasklatechnology:placipy:1.0.0:*:*:*:*:*:*:*
History

17 Jun 2026, 10:25

Type Values Removed Values Added
Summary
  • (es) PlaciPy es un sistema de gestión de prácticas diseñado para instituciones educativas. En la versión 1.0.0, las rutas GET /api/students/:email, PUT /api/students/:email/status y DELETE /api/students/:email en backend/src/routes/student.routes.ts solo aplican autenticación usando authenticateToken pero no aplican autorización. La aplicación no verifica si el usuario autenticado es propietario del registro de estudiante al que se accede, tiene un rol administrativo / de personal, o tiene permiso para modificar o eliminar al estudiante objetivo.

11 Feb 2026, 19:41

Type Values Removed Values Added
CPE cpe:2.3:a:prasklatechnology:placipy:1.0.0:*:*:*:*:*:*:*
First Time Prasklatechnology
Prasklatechnology placipy
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References () https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj - () https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj - Mitigation, Vendor Advisory

09 Feb 2026, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-09 21:15

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25806

Mitre link : CVE-2026-25806

CVE.ORG link : CVE-2026-25806

JSON object : View

Products Affected

prasklatechnology

  • placipy
CWE
CWE-862

Missing Authorization