CVE-2026-25876
Improper Authorization in PlaciPy Results Routes Allows Data Exposure
Publication date: 2026-02-09
Last updated on: 2026-02-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| prasklatechnology | placipy | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in PlaciPy version 1.0.0 is due to the backend failing to enforce object-level authorization despite verifying authentication. Specifically, in the results.routes.ts file, while the system checks if a user is authenticated, it does not verify whether the user owns or is authorized to access specific data objects. This flaw allows an attacker or unauthorized user to retrieve all results for an assessment, not just their own.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized data exposure, where users can access assessment results that they should not be able to see. This can compromise the privacy and confidentiality of sensitive educational data, potentially leading to information leaks, loss of trust, and misuse of the exposed information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know