PT-2026-7154 · Placipy · Placipy

Devdeep781 + 2 · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25806

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0

Description PlaciPy is a placement management system for educational institutions. The GET /api/students/:email, PUT /api/students/:email/status, and DELETE /api/students/:email routes do not enforce authorization. The application does not verify if the authenticated user owns the student record, has an administrative role, or is permitted to modify or delete the student data. The vulnerable parameter is email.

Recommendations Implement authorization checks for the GET /api/students/:email, PUT /api/students/:email/status, and DELETE /api/students/:email routes to ensure that only authorized users can access and modify student records.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25806

GHSA-99GR-8933-3VWJ

Affected Products

Placipy

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25806.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25806 · Vendor Advisory
• https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25806 · Security Note
• https://twitter.com/CVEnew/status/2020972046289674537 · Twitter Post