CVE-2026-25876
Analyzed Analyzed - Analysis Complete
Improper Authorization in PlaciPy Results Routes Allows Data Exposure

Publication date: 2026-02-09

Last updated on: 2026-02-11

Assigner: GitHub, Inc.

Description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-02-11
Generated
2026-06-16
AI Q&A
2026-02-09
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25876
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
prasklatechnology placipy 1.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in PlaciPy version 1.0.0 is due to the backend failing to enforce object-level authorization despite verifying authentication. Specifically, in the results.routes.ts file, while the system checks if a user is authenticated, it does not verify whether the user owns or is authorized to access specific data objects. This flaw allows an attacker or unauthorized user to retrieve all results for an assessment, not just their own.

Impact Analysis

This vulnerability can lead to unauthorized data exposure, where users can access assessment results that they should not be able to see. This can compromise the privacy and confidentiality of sensitive educational data, potentially leading to information leaks, loss of trust, and misuse of the exposed information.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart