BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-24

Assigner: CERT.PL

Description

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-04

NVD

CVE-2025-62293

Affected Vendors & Products

Vendor	Product	Version / Range
soplanning	soplanning	to 1.55.00 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in SOPlanning involves Broken Access Control in the /status endpoint. Because the Project Status functionality lacks proper permission checks, an authenticated attacker can add, edit, and delete any status without authorization.

Impact Analysis

An attacker exploiting this vulnerability could manipulate project status information by adding, editing, or deleting statuses. This could lead to misinformation, disruption of project tracking, and potential misuse of the system's status data.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade SOPlanning to version 1.55 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2025-62293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70