CVE-2025-62293
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-24

Assigner: CERT.PL

Description
SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-20
Last Modified
2025-11-24
Generated
2026-06-16
AI Q&A
2025-11-20
EPSS Evaluated
2026-06-14
NVD
CVE-2025-62293
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
soplanning soplanning to 1.55.00 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in SOPlanning involves Broken Access Control in the /status endpoint. Because the Project Status functionality lacks proper permission checks, an authenticated attacker can add, edit, and delete any status without authorization.

Impact Analysis

An attacker exploiting this vulnerability could manipulate project status information by adding, editing, or deleting statuses. This could lead to misinformation, disruption of project tracking, and potential misuse of the system's status data.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade SOPlanning to version 1.55 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart