PT-2026-45356 · Unknown · Soplanning

Łukasz Jaworski · CVE-2026-40543 · Published 2026-06-01 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.56

Description Lack of authorization enforcement for backup functionalities allows an unauthenticated attacker to query backup-related endpoints. This can lead to the retrieval of backup archives containing user databases with usernames and password hashes, as well as the config.csv file containing sensitive information.

Recommendations Update to a version later than 1.55.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40543

Affected Products

Soplanning

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-40543 · Security Note
• https://t.me/cveNotify/165485 · Telegram Post
• https://t.me/cveNotify/165488 · Telegram Post
• https://cert.pl/en/posts/2026/06/CVE-2026-40543 · Note
• https://t.me/cveNotify/165489 · Telegram Post
• https://twitter.com/f1tym1/status/2061384641672630444 · Twitter Post
• https://t.me/cveNotify/165483 · Telegram Post
• https://t.me/cveNotify/165487 · Telegram Post
• https://soplanning.org/en · Note
• https://t.me/true_secator/8286 · Telegram Post
• https://t.me/cveNotify/165484 · Telegram Post
• https://t.me/cveNotify/165486 · Telegram Post