PT-2025-47599 · Unknown · Soplanning

Published 2025-11-20 · Updated 2025-11-24 · CVE-2025-62730

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning has a flaw that allows privilege escalation through the user management tab. Users assigned the user manage team role can modify user permissions, including granting administrative privileges to themselves or other users. This allows a malicious, authenticated attacker with the user manage team role to escalate their privileges to administrator level. The issue affects both the Bulk Update functionality and the standard user rights and privileges editing process.

Recommendations Update to version 1.55 or later.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-62730

Affected Products

Soplanning

References · 9

• https://osv.dev/vulnerability/CVE-2025-62730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62730 · Security Note
• https://twitter.com/CVEnew/status/1991535329862701293 · Twitter Post
• https://t.me/CVEtracker/37840 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991681002125545726 · Twitter Post
• https://soplanning.org/en · Note
• https://t.me/cveNotify/143780 · Telegram Post
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note
• https://twitter.com/CCBalert/status/1991886978363593156 · Twitter Post