CVE-2025-62730
BaseFortify
Publication date: 2025-11-20
Last updated on: 2025-11-24
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| soplanning | soplanning | to 1.55.00 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in SOPlanning allows users with the user_manage_team role to escalate their privileges to administrative level. Although these users are supposed to only manage team permissions, they can assign administrative permissions to themselves or others, exploiting both the Bulk Update functionality and regular user rights editing. This means an authenticated user with limited permissions can gain full admin control.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized privilege escalation, allowing a user with limited permissions to gain administrative access. This can result in unauthorized changes, data exposure, or control over the system, potentially compromising the security and integrity of the affected environment.
What immediate steps should I take to mitigate this vulnerability?
Upgrade SOPlanning to version 1.55 or later, as this issue was fixed in that version. Additionally, review and restrict the assignment of the user_manage_team role to trusted users only to prevent unauthorized privilege escalation.