PT-2026-56774 · Soplanning · Soplanning

Arkadiusz Marta · Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-50644

NVD

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user).

This issue was fixed in version 1.56.01.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-50644

Affected Products

Soplanning

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-50644 · Security Note
• https://soplanning.org/en · Note
• https://cert.pl/en/posts/2026/07/CVE-2026-50644 · Note