PT-2026-45356 · Soplanning · Soplanning

Łukasz Jaworski · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-40543

NVD

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information.

This issue affects SOPlanning version 1.55 and below.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40543

Affected Products

Soplanning

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40543 · Security Note
• https://cert.pl/en/posts/2026/06/CVE-2026-40543 · Note
• https://soplanning.org/en · Note
• https://twitter.com/f1tym1/status/2061384641672630444 · Twitter Post